AWS AccessDenied vs GCP PERMISSION_DENIED (403)

Quick Decision

• -Use AWS AccessDenied path when AWS returns AccessDenied/AccessDeniedException for an authenticated caller.
• -Use GCP PERMISSION_DENIED path when Google RPC status is PERMISSION_DENIED (not UNAUTHENTICATED, not RESOURCE_EXHAUSTED).
• -Classify from provider error code and policy context first, then map remediation to the exact deny layer.

Key Differences

• -AWS authorization evaluation combines identity-based policies, resource-based policies, boundaries, session policies, and org controls; explicit deny overrides allow.
• -GCP PERMISSION_DENIED means the caller lacks required permission or is blocked by policy, while unidentified callers should be UNAUTHENTICATED.
• -PERMISSION_DENIED must not be used for exhausted resources; Google documents RESOURCE_EXHAUSTED for quota/capacity exhaustion.
• -Both often map to HTTP 403, but root-cause debugging differs by provider policy model and telemetry fields.

Step-by-Step Diagnosis

1. 1Capture principal, action/permission, resource, account/project scope, and provider request ID from the failing call.
2. 2For AWS, review policy evaluation path for explicit deny, missing allow, boundary/session constraints, and org controls.
3. 3For GCP, verify required permission and analyze IAM allow/deny outcomes with Policy Troubleshooter where applicable.
4. 4Retest with minimal-scoped permission changes and remove temporary broad grants after confirming root cause.

Common Misclassifications

• -Treating authorization denial as authentication failure and rotating credentials without policy analysis.
• -Classifying quota/capacity failures as PERMISSION_DENIED instead of RESOURCE_EXHAUSTED.
• -Granting broad admin roles before identifying explicit deny, missing allow, or scope mismatch.
• -Debugging the wrong account/project context while the real deny is in another tenancy boundary.

Response Examples

HTTP/1.1 403 Forbidden
Content-Type: application/xml

<Error>
  <Code>AccessDenied</Code>
  <Message>Access Denied</Message>
  <RequestId>4442587FB7D0A2F9</RequestId>
  <HostId>host-id-redacted</HostId>
</Error>

HTTP/1.1 403 Forbidden
Content-Type: application/json

{
  "error": {
    "code": 403,
    "status": "PERMISSION_DENIED",
    "message": "Permission denied on resource."
  }
}

Pro Tip

Frequently Asked Questions