AWS - DecodeAuthorizationMessage Not authorized to decode message

Question

Even though I'm an admin on the account, I added an IAM role as follows on a specific EC2 and I'm still getting the same error:

An error occurred (InvalidAuthorizationMessageException) when calling the DecodeAuthorizationMessage operation: Not authorized to decode message

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:DecodeAuthorizationMessage"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Why can't I decode the error message?

Answer 1

This error message is misleading. You have privileges to decode the message but you're sending an invalid message to decode.

InvalidAuthorizationMessage
The error returned if the message passed to DecodeAuthorizationMessage was invalid. This can happen if the token contains invalid characters, such as linebreaks.

If you were not authorized to perform the operation you'd receive an error message similar to this:

A client error (AccessDenied) occurred when calling the DecodeAuthorizationMessage operation

References

• API_DecodeAuthorizationMessage
• Troubleshoot IAM Policy Issues

Answer 2

I ran into the same error message today. In my case, the encoded input message was a valid error message from one AWS account, but unfortunately I was using a default user profile with privileges to decode an authorization error message from a different AWS account. So the error returned from the decode-authorization-message command was accurate, I did not have the necessary privileges to decode the message sent in. The fix was to get the necessary credentials through the AWS SSO login process, copy those into the .aws/credentials file, and try again.

Notes: (1) it's a good idea to back up the aws credentials file prior to editing it. (2) Also, use the command line option --profile {profile name} to switch to a user profile other than the default. (3) The AWS credentials for an SSO user include a token which eventually expires - I do not know the time limit - so if you want to use the CLI with the same SSO user later, you may need to regenerate and save updated credentials first.