Why am I getting an Access Denied error when trying to create a CloudFront invalidation?
Asked by
TechieTurtle77
I'm encountering an Access Denied error while trying to create an invalidation for my CloudFront distribution, even though my IAM user has AdministratorAccess, AmazonS3FullAccess, and CloudFrontFullAccess policies attached. I've tried both the UI and CLI methods, and I get the same error message on both. Is there something that I'm missing that could be causing this issue?
Answers
Make sure that there's no explicit deny in your SCP or resource policy. It's worth checking if your distributions have resource policies since those could also impact your access.
Reply to this answer
First, double-check if your IAM user has any permissions boundaries set up, and see if there are any Service Control Policies (SCPs) in place that could be affecting your access. Those might be the culprits here.
Reply to this answer
You could also try using the wildcard permissions like CloudFront:* in case there's something else blocking you. If that's already included in your CloudFrontFullAccess policy, it might be worth checking with the account owner to see if there's anything on their side causing this.
Reply to this answer
Have you looked at the CloudTrail logs in us-east-1? They can give you insights, even if the reasons for denial can sometimes be a bit cryptic.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions