DocsICP FilingConsole
Documentation

DecodeDiagnosticMessage

Updated at:
Copy as MD
Product
My Favorites

Decodes the diagnostic information from the response body of a request that is denied due to insufficient RAM permissions.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

  • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

  • API: The API that you can call to perform the action.

  • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

  • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

    • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

    • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

  • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

  • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

ram:DecodeDiagnosticMessage

get

*All Resource

*

 None None

Request parameters

Parameter

Type

Required

Description

Example
EncodedDiagnosticMessage

string

No

The encoded diagnostic information obtained from the AccessDeniedDetail.EncodedDiagnosticMessage field in the response body when an API request is denied due to insufficient permissions. This parameter is used to decode the access denied diagnostic information and is required when you call this operation.

AQEAAAAAZBgxr0U1MjA1NTM1LUM4BBktMzE5RS1CODgxLUU1QTI0RDNFQTM1****

Response elements

Element

Type

Description

Example

object

The response result.

RequestId

string

The request ID.

D2331703-AADF-5564-BA9B-26CD51A33BA0
DecodedDiagnosticMessage

object

The decoded diagnostic information.

ExplicitDeny

boolean

Indicates whether the request is explicitly denied.

Valid values:

  • true :

    explicitly denied.

  • false :

    not explicitly denied.

true
NoPermissionPolicyType

string

The type of the policy that results in the access denied error.

Valid values:

  • AssumeRolePolicy :

    role trust policy.

  • ControlPolicy :

    control policy.

  • AccountLevelIdentityBasedPolicy :

    account-level identity-based policy.

  • ResourceGroupLevelIdentityBasedPolicy :

    resource group-level identity-based policy.

  • SessionPolicy :

    session policy.

AccountLevelIdentityBasedPolicy
AuthAction

string

The action used for authentication in the user request.

ram:DecodeDiagnosticMessage
AuthResource

string

The resource used for authentication in the user request.

*
AuthPrincipal

object

The principal used for authentication in the user request.

AuthPrincipalType

string

The identity type used for authentication in the user request.

Valid values:

  • SubUser :

    Resource Access Management (RAM) user.

  • AssumedRoleUser :

    RAM role.

  • Federated :

    SSO federated identity.

SubUser
AuthPrincipalOwnerId

string

The UID of the Alibaba Cloud account to which the identity used for authentication in the user request belongs.

196813200012****
AuthPrincipalDisplayName

string

The identity identifier used for authentication in the user request. The value varies based on the identity type:

  • Resource Access Management (RAM) user: the UID of the RAM user.

  • RAM role: the role name and role session name (example: RoleName:RoleSessionName).

  • SSO federated identity: the identity provider type and identity provider name (example: saml-provider/AzureAD).

28877424437521****
AuthConditions

array<object>

The list of conditions used for authentication in the user request.

object

The authentication condition.

ConditionKey

string

The condition key.

acs:SourceIp
ConditionValues

array

The list of values corresponding to the condition key.

string

The condition value corresponding to the condition key.

172.16.215.218
MatchedPolicies

array<object>

The list of policies matched during authentication.

object

The policy matched during authentication.

Effect

string

The policy effect.

Valid values:

  • Deny :

    deny.

  • Allow :

    allow.

Deny
PolicyIdentifier

string

The policy name information. The value varies based on the policy type:

  • Control policy: the ID of the control policy.

  • RAM access policy: the name of the access policy.

MyPolicyName
PolicyType

string

The policy type.

Valid values:

  • Custom :

    custom policy.

  • System :

    system policy.

Custom
PolicyVersion

string

The policy version number.

Note

Only a custom policy has a version number.

v1
AttachedEntityType

string

The type of the entity to which the policy is attached.

Valid values:

  • RamUser :

    Resource Access Management (RAM) user.

  • RamRole :

    RAM role.

  • ResourceDirectoryTarget :

    resource directory entity.

  • RamGroup :

    RAM user group.

RamUser
AttachedScope

string

The scope to which the policy is attached.

Valid values:

  • Account :

    Alibaba Cloud account.

  • Folder :

    resource directory folder.

  • ResourceGroup :

    resource group.

Account

Examples

Success response

JSON format

{
  "RequestId": "D2331703-AADF-5564-BA9B-26CD51A33BA0",
  "DecodedDiagnosticMessage": {
    "ExplicitDeny": true,
    "NoPermissionPolicyType": "AccountLevelIdentityBasedPolicy",
    "AuthAction": "ram:DecodeDiagnosticMessage",
    "AuthResource": "*",
    "AuthPrincipal": {
      "AuthPrincipalType": "SubUser",
      "AuthPrincipalOwnerId": "196813200012****",
      "AuthPrincipalDisplayName": "28877424437521****"
    },
    "AuthConditions": [
      {
        "ConditionKey": "acs:SourceIp",
        "ConditionValues": [
          "172.16.215.218"
        ]
      }
    ],
    "MatchedPolicies": [
      {
        "Effect": "Deny",
        "PolicyIdentifier": "MyPolicyName",
        "PolicyType": "Custom",
        "PolicyVersion": "v1",
        "AttachedEntityType": "RamUser",
        "AttachedScope": "Account"
      }
    ]
  }
}

Error codes

HTTP status code

Error code

Error message

Description
400 NotSupport This method can only be invoked by customer, sub user and assumed role user.
400 EncodedMessageExpire The EncodedDiagnosticMessage is expired.
403 NoPermission You do not have the required permissions.
404 SearchInaccurate The search result is inaccurate, please retry later.
404 EntityNotExist The specific DecodedDiagnosticMessage cannot be found.
429 TooManyRequests Too many search requests at same time, please retry later.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.