'AccessDeniedException' When Rekognition Is Blocked by IAM Permission Boundary
Why AdministratorAccess still fails when a permission boundary caps your role’s maximum permissions
Category: IAM & Permission Boundaries
Problem
Your application calls DetectLabels in Amazon Rekognition.
The IAM role shows:
AdministratorAccessattached- Explicit
rekognition:*permissions - No Service Control Policy blocking the account
Yet the call fails with:
AccessDeniedException: User is not authorized to perform: rekognition:DetectLabels
IAM looks correct.
SCPs are not involved.
Still denied.
Clarifying the Issue
An IAM permission boundary may be attached to the role.
A permission boundary is not a normal policy.
It defines the maximum permissions the role is allowed to receive.
Even if the role has AdministratorAccess, the boundary acts as a ceiling.
If the boundary does not explicitly allow rekognition:DetectLabels, the action becomes an implicit deny.
In IAM evaluation logic:
📌 Effective permissions are the intersection (overlap) between identity policies and the permission boundary.
📌 If Rekognition is not allowed in the boundary, the request fails.
Why It Matters
Permission boundaries are commonly used in:
- Delegated IAM role creation models
- Enterprise development environments
- Self-service account provisioning
- CI/CD pipelines that restrict blast radius
They are often invisible during casual inspection.
Engineers see “Admin” and assume full access.
But boundaries silently cap the role.
This is a role-level boundary issue — not a Rekognition issue.
Key Terms
- Permission Boundary – A policy attached to a role that defines the maximum permissions that role can receive.
- Identity Policy – Policies directly attached to the role (managed or inline).
- Implicit Deny – Any action not explicitly allowed is denied by default.
- Effective Permission Set – The intersection of identity policies and the permission boundary.
Steps at a Glance
- Confirm the execution role ARN.
- Check whether a permission boundary is attached.
- Inspect the boundary policy for Rekognition permissions.
- Identify implicit deny caused by missing allow.
- Validate using IAM Policy Simulator.
- Update the boundary or request modification from IAM administrators.
Detailed Steps
Step 1: Confirm the Execution Role
From Lambda logs or application configuration, confirm the exact IAM role ARN making the call.
Do not assume the expected role is being used.
Validate the caller identity before debugging policies.
Step 2: Check for an Attached Permission Boundary
Open IAM → Roles → Select the role.
Review the Permissions boundary section.
If a boundary is attached, note the policy name.
This boundary applies regardless of identity policies.
Step 3: Inspect the Boundary Policy
Open the boundary policy document.
Look for statements allowing:
{
"Effect": "Allow",
"Action": "rekognition:*",
"Resource": "*"
}
If Rekognition is missing entirely from the boundary, the role cannot perform those actions — even if AdministratorAccess is attached.
Step 4: Identify Implicit Deny Behavior
Permission boundaries do not need explicit denies to block access.
If Rekognition is not explicitly allowed in the boundary, the action is implicitly denied.
This is subtle and commonly misunderstood.
AdministratorAccess cannot elevate beyond the boundary ceiling.
Step 5: Validate with IAM Policy Simulator
Use IAM Policy Simulator:
- Select the role
- Include the boundary
- Simulate
rekognition:DetectLabels
The simulator will show whether the action is allowed or denied and why.
This confirms boundary involvement.
Step 6: Update the Boundary
To resolve:
- Modify the permission boundary to include Rekognition actions
- Or request boundary changes from the IAM governance team
You cannot fix this by modifying the identity policy alone.
The ceiling must change.
Pro Tips
- Permission boundaries are often applied automatically during role creation.
- AdministratorAccess does not bypass a boundary.
- If IAM and SCP look correct, check the boundary next.
- Boundaries frequently block newly introduced AWS services.
- Always inspect the boundary before escalating to governance teams.
If everything “looks admin” but still fails, suspect a boundary.
Conclusion
AccessDeniedException in Rekognition with correct IAM policies and no SCP involvement often points to a permission boundary.
A boundary defines the maximum permissions a role can receive.
If Rekognition is not allowed in that boundary, the role cannot perform the action — regardless of attached policies.
This is a role-level boundary issue — not a Rekognition issue.
Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.
Comments
Post a Comment