Error: "AccessDeniedException"

Scenario

You get an Access Denied exception when trying to share a resource or view a resource share.

Cause

You can receive this error if you attempt to create a resource share when you don't have the required permissions. This can be caused by insufficient permissions in policies attached to your AWS Identity and Access Management (IAM) principal. It can also happen because of restrictions in place from an AWS Organizations service control policy (SCP) that affects your AWS account.

Solution

To provide access, add permissions to your users, groups, or roles:

To resolve the error, you need to ensure the permissions are granted by Allow statements in the permission policy used by the principal that makes the request. In addition, the permissions must not be blocked by your organization’s SCPs.

To create a resource share, you need the following two permissions:

To view a resource share, you need the following permission:

To attach permissions to a resource share, you need the following permission:

The following example shows what such an IAM permission policy might look like.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ram:CreateResourceShare", 
                "ram:AssociateResourceShare",
                "ram:GetResourceShares",
                "resourceOwningService:PutPolicyAction"
            ],
            "Resource": "*"
        }
    ]
}