cloud iam_permission ai_generated true

AccessDenied: User is not authorized to perform this action even after policy is attached

ID: cloud/aws-iam-eventual-consistency

Also available as: JSON · Markdown
82%Fix Rate
90%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

IAM policy changes take up to 60 seconds to propagate globally due to eventual consistency. AWS docs mention this in a footnote but most tutorials show attach-then-use immediately.

generic

Workarounds

  1. 95% success Implement retry with exponential backoff after IAM changes 
    for i in range(6): try: client.action() except AccessDenied: time.sleep(2**i)
  2. 85% success Use STS AssumeRole to force fresh credential evaluation 
    After attaching policy, assume the role again to get fresh session credentials
  3. 80% success Use IAM policy simulator API to verify propagation before proceeding 
    iam.simulate_principal_policy(PolicySourceArn=role_arn, ActionNames=['s3:GetObject'])

Dead Ends

Common approaches that don't work:

  1. Attach IAM policy and immediately make API call 90% fail

    IAM is eventually consistent. Policy may take 10-60 seconds to propagate. First call almost always fails.

  2. Detach and reattach the policy thinking it didn't apply 82% fail

    Reattaching resets the propagation timer. Makes the problem worse.

  3. Add a hardcoded sleep(5) after policy attachment 72% fail

    5 seconds is often not enough. Propagation can take up to 60 seconds in some regions.