AWS Console Access Denied for IAM User – 3 Causes & Fixes

1. Missing or Wrong IAM Policy for Console Access

This is the one I see most. You create an IAM user, give them a password, but forget the policy that actually lets them use the console. What's happening here is the AWS console is just a web app. Without a policy that allows iam:ChangePassword and iam:GetLoginProfile, the console says 'no'.

Check the user's policies

1. Log in as root or an admin user.
2. Go to IAM > Users > click the user.
3. Under 'Permissions', look at the attached policies.
4. If you see nothing or only an S3-read policy, that's your problem.

The fix: attach the right managed policy

The quickest fix is to attach AWSCloudShellFullAccess or IAMUserChangePassword. But if you want minimal permissions, create an inline policy like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:ChangePassword",
        "iam:GetLoginProfile"
      ],
      "Resource": "arn:aws:iam::*:user/${aws:username}"
    }
  ]
}

That gives the user just enough to sign in and change their own password. Nothing else. The reason GetLoginProfile matters is because the console checks if the user has a login profile before showing the dashboard. Without it, the console returns AccessDenied.

2. User Tried the Wrong Console URL

This one's embarrassing but common. Your IAM user is set up fine, but they try to log in at https://console.aws.amazon.com. That's the root user or admin URL. For an IAM user, you need the account-specific URL.

What's actually happening

The generic console URL redirects to the root sign-in page. IAM users don't have a root account, so AWS shows 'Access Denied' even though the user exists. The fix is simple: use the correct URL format.

Find your account alias or ID

1. Go to IAM > Dashboard.
2. Look for 'AWS account' – it shows a 12-digit number and an alias if you set one.
3. Give your user this URL: https://.signin.aws.amazon.com/console

If you don't have an alias, create one. It's much easier to remember:

aws iam create-account-alias --account-alias mycompany-dev

Now your users go to https://mycompany-dev.signin.aws.amazon.com/console. No more AccessDenied just because of a wrong URL.

3. Service Control Policy (SCP) Is Blocking Console Access

If you're in an AWS Organizations setup, an SCP can deny console access even if the IAM policy allows it. This one's tricky because the error message looks the same: 'Access Denied'. But the cause is higher up – at the organization level.

Check if you're under an SCP

1. Log in as a management account admin (or ask someone who can).
2. Go to AWS Organizations > Policies > Service control policies.
3. Check if any SCP attached to the account or OU has a deny statement for iam:ChangePassword or iam:GetLoginProfile.

A common SCP that blocks console access

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "iam:ChangePassword",
        "iam:GetLoginProfile",
        "iam:CreateLoginProfile"
      ],
      "Resource": "*"
    }
  ]
}

This SCP is often used to prevent users from creating or changing their own login profiles. The reason it blocks console access is because the console needs GetLoginProfile to verify the user. If the SCP denies that, the console can't proceed.

The fix: modify the SCP

You can't fix this from the IAM user side. You need to edit the SCP to allow those actions, or remove the deny. A better approach: scope the deny to specific resources or actions you actually want to block, not the whole console.

“SCPs override IAM policies. If an SCP denies something, no IAM policy can allow it. This is why you check SCPs last – they're the highest authority in the chain.”

Quick-Reference Summary Table

Start with cause #1. It's the most likely. If that's not it, move to #2. SCPs are rare unless you're in a big org. But when they hit, they hit hard.