How can I apply my local cli after changed IAM on AWS management console

Question

• Prerequisite

  • I usually use aws-mfa
  • I tried to terraform apply
  • I got a problem of insufficient IAM. But it might be resolved by: User: x is not authorized to perform: (sts:DecodeAuthorizationMessage)`
    • The answer makes sense.

• What I did

  • Added the IAM Permission to my policy(this attached to my group)
  • Checked sts get-caller-identity on my local as my IAM User.
  • IAM Policy Simulator told me that the IAM Group includes my IAM User is permitted to perform sts: DecodeAuthorizationMessage...

• Problem

  • The IAM I added seems to be not applied on my local.
    • it still shows <my IAM USER> is not authorized to perform: sts:DecodeAuthorizationMessage with an explicit deny in an identity-based policy

• Ask

  • Anyone can resolve the problem?
  • And, please let me know that the timing gap of between aws cli and aws management console. How much does it takes?
  • Moreover, how can I immediately apply to aws cli after IAM changed on aws management console?

Answer 1

Add this as an inline policy to your IAM user,

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowStsDecode",
      "Effect": "Allow",
      "Action": "sts:DecodeAuthorizationMessage",
      "Resource": "*"
    }
  ]
}