AWS CLI Command Reference

[ aws . iam-toolbox ]

get-request-authorization-details

Description

Retrieves the authorization details for a specific access denied request. The details include the request context, the evaluations performed, and the policies that were evaluated.

Use this operation to understand why a request was denied. Supported services include an authorization ID in the access denied error message. Pass that ID to this operation to retrieve the details.

Authorization details are available for at least 24 hours after the denial.

To use this operation, you must have the iam:GetRequestAuthorizationDetails permission.

See also: AWS API Documentation

get-request-authorization-details uses document type values. Document types follow the JSON data model where valid values are: strings, numbers, booleans, null, arrays, and objects. For command input, options and nested parameters that are labeled with the type document must be provided as JSON. Shorthand syntax does not support document types.

get-request-authorization-details is a paginated operation. Multiple API calls may be issued in order to retrieve the entire data set of results. You can disable pagination by providing the --no-paginate argument. When using --output text and the --query argument on a paginated response, the --query argument must extract data from the results of the following query expressions: evaluations

Synopsis

  get-request-authorization-details
--authorization-id <value>
[--starting-token <value>]
[--max-items <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
[--cli-error-format <value>]

Options

--authorization-id (string) [required]

The authorization ID received in the access denied error message. This ID identifies the specific request to retrieve details for.

Constraints:

  • pattern: [0123456789abcdefghijklmnopqrstuvwxyz]+

--starting-token (string)

A token to specify where to start paginating. This is the NextToken from a previously truncated response.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

--max-items (integer)

The total number of items to return in the command’s output. If the total number of items available is more than the value specified, a NextToken is provided in the command’s output. To resume pagination, provide the NextToken value in the starting-token argument of a subsequent command. Do not use the NextToken response element directly outside of the AWS CLI.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

Global Options

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command’s default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

  • json
  • text
  • table
  • yaml
  • yaml-stream
  • off

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

  • on
  • off
  • auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

--cli-binary-format (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.

  • base64
  • raw-in-base64-out

--no-cli-pager (boolean)

Disable cli pager for output.

--cli-auto-prompt (boolean)

Automatically prompt for CLI input parameters.

--no-cli-auto-prompt (boolean)

Disable automatically prompt for CLI input parameters.

--cli-error-format (string)

The formatting style for error output. By default, errors are displayed in enhanced format.

  • legacy
  • json
  • yaml
  • text
  • table
  • enhanced

Output

requestContext -> (map)

The request context is the set of context keys and values that apply to the entire request and are shared by all evaluations.

key -> (string)

value -> (document)

evaluations -> (list)

The list of evaluations for this request. Each evaluation shows how a single action and resource pair was evaluated. This includes the context, the effect, and any policies that matched.

(structure)

Represents an individual evaluation for a single action and resource pair. This includes the context, the resulting effect, and any policies that matched.

action -> (string) [required]

The action evaluated for this request (for example, iam:PassRole ).

resource -> (string) [required]

The resource that the action targeted. This is typically a resource ARN, but can be a wildcard ARN that matches multiple resources, or empty for actions that are not resource-specific.

context -> (map)

The context keys and values specific to this evaluation. These are applied on top of the request context.

key -> (string)

value -> (document)

evaluatedEffect -> (string)

The result of the evaluation. Valid values:

  • ALLOW - The action was allowed.
  • EXPLICIT_DENY - The action was explicitly denied by a policy.
  • IMPLICIT_DENY - The action was denied because no policy allowed it.

Possible values:

  • ALLOW
  • EXPLICIT_DENY
  • IMPLICIT_DENY

matchedPolicies -> (list)

The policies that matched during evaluation of this action and resource. An implicit denial produces no matched policies.

(structure)

A policy that matched during evaluation, referenced by URI. The URI corresponds to a policy in the top-level policies list.

uri -> (string) [required]

The URI of the policy. This cross-references an entry in the top-level policies list. The value depends on the policy type:

  • For managed policies, this is the policy ARN.
  • For inline policies, this is an opaque identifier.

matchedStatements -> (list)

The statements within the policy that matched during the evaluation.

(structure)

A statement that matched during evaluation.

sid -> (string)

The statement ID (Sid). If the statement has no Sid, one is generated for reference.

evaluatedEffect -> (string)

The evaluated effect of this statement. Valid values:

  • ALLOW - The statement allows the action.
  • DENY - The statement denies the action.

Possible values:

  • ALLOW
  • DENY

policies -> (list)

The list of policies that were evaluated.

(structure)

Contains details about a policy evaluated during authorization. Details include the policy type, whether it is inline or managed, a URI that identifies it, and the entities it is attached to.

type -> (string)

The type of policy. Valid values:

  • IDENTITY_BASED_POLICY - An identity-based policy attached to an IAM user, group, or role.
  • PERMISSIONS_BOUNDARY - A permissions boundary for an IAM entity.
  • RESOURCE_BASED_POLICY - A resource-based policy attached to a resource.
  • RESOURCE_CONTROL_POLICY - A resource control policy (RCP) in AWS Organizations.
  • SERVICE_CONTROL_POLICY - A service control policy (SCP) in AWS Organizations.
  • SESSION_POLICY - A session policy passed during role assumption or federation.
  • VPC_ENDPOINT_POLICY - A VPC endpoint policy.

Possible values:

  • IDENTITY_BASED_POLICY
  • RESOURCE_BASED_POLICY
  • PERMISSIONS_BOUNDARY
  • SESSION_POLICY
  • SERVICE_CONTROL_POLICY
  • RESOURCE_CONTROL_POLICY
  • VPC_ENDPOINT_POLICY

inline -> (boolean)

Specifies whether this is an inline policy (true ) or a managed policy (false ).

uri -> (string)

A URI that identifies the policy. Use this URI to cross-reference the policy with the matching policies in each evaluation. The value depends on the policy type:

  • For managed policies, this is the policy ARN.
  • For inline policies, which have no ARN, this is an opaque identifier.

attachedTo -> (list)

The entities that the policy is attached to. For identity, session, and resource-based policies, this is typically a single entity. For organization control policies (SCPs and RCPs), it can be multiple entities at different levels of the organization hierarchy.

(structure)

An entity that a policy is attached to, identified by its ARN.

arn -> (string)

The ARN of the entity that the policy is attached to. The ARN format depends on the policy type:

  • For identity, session, and permissions boundary policies, this is the principal ARN (for example, an IAM role or user ARN).
  • For resource-based policies, this is the resource ARN.
  • For organization control policies (SCPs and RCPs), this is the AWS Organizations ARN of the account, organizational unit, or root.

Constraints:

  • pattern: arn:[^:]*:[^:]*:[^:]*:[^:]*:.*

nextToken -> (string)

The pagination token for retrieving the next page of evaluations. This value is absent when there are no more results.
© Copyright 2026, Amazon Web Services. Created using Sphinx.