Question

When calling an API operation on an EC2 Instance, the following error message was returned. A client error (UnauthorizedOperation) occurred when calling the RunInstances operation: You are not authorized to perform this operation.

Encoded authorization failure message: oGsbAaIV7wlfj8zUqebHUANHzFbmkzILlxyj__y9xwhIHk99U_cUq1FIeZnskWDjQ1wSHStVfdCEyZILGoccGpC iCIhORceWF9rRwFTnEcRJ3N9iTrPAE1WHveC5Z54ALPaWlEjHlLg8wCaB8d8lCKmxQuylCm0r1Bf2fHJRU jAYopMVmga8olFmKAl9yn_Z5rI120Q9p5ZIMX28zYM4dTu1cJQUQjosgrEejfiIMYDda8l7Ooko9H6VmGJX S62KfkRa5l7yE6hhh2bIwA6tpyCJy2LWFRTe4bafqAyoqkarhPA4mGiZyWn4gSqbO8oSIvWYPwea KGkampa0arcFR4gBD7Ph097WYBkzX9hVjGppLMy4jpXRvjeA5o7TembBR-Jvowq6mNim0 Which of the following can be used to get a human-readable error message?

A. Use the command aws sts decode-authorization-message.

B. Use the command aws get authorization-message.

C. Use the IAM Policy simulator, enter the error message to get the human readable format.

D. Use the command aws set authorization-message.

Answer 1

Answer - A.

This is mentioned in the AWS Documentation.

Decodes additional information about the authorization status of a request from an encoded message returned in response to an AWS request.

For example, if a user is not authorized to perform an action that he or she has requested, the request returns a Client.UnauthorizedOperation response (an HTTP 403 response)

Some AWS actions additionally return an encoded message that can provide details about this authorization failure.

Because of the right command used in the documentation, all other options are incorrect.

For more information on the command, please refer to the below URL-

https://docs.aws.amazon.com/cli/latest/reference/sts/decode-authorization-message.html

The error message indicates that the user or role attempting to call the RunInstances operation on the EC2 instance is not authorized to do so. The encoded message included in the error is not human-readable and must be decoded to get a more understandable error message.

Option A is the correct answer as it suggests using the aws sts decode-authorization-message command to decode the encoded error message. This command decodes the authorization failure message and returns a human-readable error message that provides information about why the request was denied. This option will provide the most direct and accurate method of obtaining a human-readable error message.

Option B, aws get authorization-message, is not a valid AWS CLI command and will not return any results.

Option C, using the IAM Policy simulator, may provide a way to test different policy scenarios to see if they would allow or deny the requested action. However, it does not provide a direct method to obtain a human-readable error message for a specific API operation.

Option D, aws set authorization-message, is not a valid AWS CLI command and is not relevant to decoding or obtaining a human-readable error message.

In summary, the correct answer is A, as it provides the most direct method of obtaining a human-readable error message for the UnauthorizedOperation error.