Databricks Community

jvk · ‎04-18-2024

Full error here:

Aws Authorization Failure:
Failure happened when talking to AWS, AWS API error code: AccessDenied AWS error message: User: arn:aws:iam::414351767826:user/ConsolidatedManagerIAMUser-ConsolidatedManagerUser-VX02FYW0SSCY is not authorized to perform: sts:AssumeRole on resource:

Would you know why this could occur?

Kaniz_Fatma · ‎04-19-2024

Hi @jvk, The “AccessDenied” error message you’re encountering in AWS indicates that the user “arn:aws:iam::414351767826:user/ConsolidatedManagerIAMUser-ConsolidatedManagerUser-VX02FYW0SSCY” does not have the necessary permissions to perform the “sts:AssumeRole” action on a specific resource.

Verify that the user has the correct permissions to assume the specified role. You can do this by examining the user’s IAM policies.
Ensure that there is an explicit “Allow” statement for the “sts:AssumeRole” action in the user’s policy. If there is no applicable “Allow” statement, the policy implicitly denies access.
Remember that IAM policies deny access by default, so you must explicitly allow the principal (user) to perform the desired action.
Access-denied errors can occur due to explicit or implicit denials:
- Explicit Denial: When a policy contains a “Deny” statement for the specific AWS action.
- Implicit Denial: When there is neither an applicable “Deny” nor an “Allow” statement.
Make sure to understand the policy type responsible for the denial.
Look for additional details in the error message. It might mention the type of policy responsible for the denial (e.g., Service Control Policy).
If not, follow the guidelines mentioned above to troubleshoot further.

View solution in original post

daniel_sahal · ‎04-19-2024

@jvk
This is definitely a permission issues.

Kaniz_Fatma · ‎04-19-2024

Hi @jvk, The “AccessDenied” error message you’re encountering in AWS indicates that the user “arn:aws:iam::414351767826:user/ConsolidatedManagerIAMUser-ConsolidatedManagerUser-VX02FYW0SSCY” does not have the necessary permissions to perform the “sts:AssumeRole” action on a specific resource.

Verify that the user has the correct permissions to assume the specified role. You can do this by examining the user’s IAM policies.
Ensure that there is an explicit “Allow” statement for the “sts:AssumeRole” action in the user’s policy. If there is no applicable “Allow” statement, the policy implicitly denies access.
Remember that IAM policies deny access by default, so you must explicitly allow the principal (user) to perform the desired action.
Access-denied errors can occur due to explicit or implicit denials:
- Explicit Denial: When a policy contains a “Deny” statement for the specific AWS action.
- Implicit Denial: When there is neither an applicable “Deny” nor an “Allow” statement.
Make sure to understand the policy type responsible for the denial.
Look for additional details in the error message. It might mention the type of policy responsible for the denial (e.g., Service Control Policy).
If not, follow the guidelines mentioned above to troubleshoot further.

jvk · ‎04-21-2024

Where would I go to adjust the IAM policies for databricks? Would this need to be done in my AWS account? I don't remember having to connect AWS to databricks in order to set up the cluster initially.