AWS Error AccessDeniedException: Access denied (JSON-protocol services)

Error✕ Not retryable · fix the payloadHTTP 400 Bad RequestAPI Gateway

TL;DR · 10-second read

IAM denied the action for this principal (Secrets Manager, DynamoDB, KMS, Lambda and other JSON-protocol services use this name). Add the exact action and resource ARN to the role policy.

Identify: does your log match?

What you see · exact log / response

An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:sts::123456789012:assumed-role/app-task-role/9f1c2e7a is not authorized to perform: secretsmanager:GetSecretValue on resource: prod/db because no identity-based policy allows the secretsmanager:GetSecretValue action

Fix

Being written

Copy-paste fixes for AccessDeniedException are in the enrichment queue

The summary above is verified. Paste your full trace into the decoder for a diagnosis now.

Open the decoder →

Related errors

Last verified 2026-10-15 · Source: botocore service models (errors per operation) · Official docs ↗ · ~6,600 searches/mo