‫So when you run API calls
‫and they fail like we just did in the previous lecture
‫we can get a long error message that doesn't mean much,
‫and we want to be able to decode it.
‫And for this, it's a very popular question
‫as well on the exam, you need the STS command line.
‫So you have to run this sts decode-authorization-message
‫to decode the messages.
‫There is no better way to practice this concept,
‫so let's have a look how this works.
‫As you remember, when we did the EC2
‫run-instances dry-run, we got this,
‫you are not authorized to perform this operation,
‫and then it gave us this entire message
‫as an authorization failure.
‫Now we want to decode it.
‫So for this, I'll just go in Google
‫and type AWS sts decode-authorization-message.
‫Click on it, and basically it says
‫we can decode additional information
‫about the authorization status of the request.
‫So the way to use it is to just run
‫decode-authorization-message, and then
‫we pass a flag called encoded-message,
‫and the value of the message.
‫So now let's have a look how this works.
‫We'll do aws sts decode-authorization-message.
‫And I need to make sure I get this right.
‫We have passed the encoded-message and the values.
‫So encoded-message, and we'll pass this entire message,
‫all the way from here, from the vb to the 1k.
‫I'll paste it and press enter.
‫And now we get, obviously, maybe you
‫predicted it, an access denied.
‫It's because our IAM use role is not authorized
‫to perform this operation, the STS.
‫So basically any time you run an AWS API call,
‫you have to authorize yourself.
‫So we could run this straight from our computer
‫and it will work, but just for the fun
‫and practicing, I will authorize my EC2 instance
‫to run this command.
‫So let's have a look.
‫We go back to the IAM management console
‫and we'll edit the policy.
‫We'll add an additional permission.
‫For the service, we'll choose STS
‫and then we'll basically authorize
‫a read or a write operation.
‫It is actually a write operation.
‫We'll authorize a decode authorization message.
‫We don't need to choose resources,
‫and we don't need to specify conditions.
‫We'll review the policy, and now we have
‫an STS permission, we'll save the changes.
‫And once this is done, our EC2 instance
‫should have a statement right here,
‫allow, saying you're allowed to decode
‫authorization messages.
‫That sounds about right.
‫Now let's give it a try.
‫So I'll run the exact same command right here
‫and, as you can see now, we get a decoded message.
‫Now, this message, I have to admit,
‫isn't extremely helpful right now.
‫But if you were running an API call
‫that had, you know, some very interesting information,
‫then you would get it from the sts decode message.
‫You can always use to echo this,
‫so let's just echo this to see how it works.
‫We'll echo, and now we get
‫a slightly better format of it.
‫What I like to do is just copy
‫this JSON file under my VS code.
‫So here I paste it, I say that it is a JSON document,
‫so we get slightly better formatting.
‫And then using a quick action, I can basically
‫reformat, format the file, so format the selection,
‫and this gives me a better JSON document.
‫So we can see now, we haven't been allowed,
‫we didn't get an explicit denied.
‫If it gets allowed or denied we get
‫a matched statements, which helps us
‫basically drill down into why there was an error,
‫or if we get failures, they're also right here.
‫And then it gives us a bunch of context
‫around the API call that was made,
‫such as the ID, the ARN of the API call,
‫and for example here we see that it's
‫the IAM role MyFirstEC2Role
‫that was running from this instance ID, excellent.
‫And then we tried to run a RunInstances API call
‫on this resource, and it turns out
‫that all these parameters were specified.
‫So as you can see, there's a lot happening here.
‫But from, what I want you to understand
‫is that from this very cryptic, long,
‫let me just show it to you again,
‫from this very cryptic, long message,
‫using the sts decode-authorization-message,
‫we are able to decrypt it and get
‫valuable information out of it.
‫And that's all you should know for the exam.
‫You have to run the sts decode-authorization-message API.
‫So I hope that was hopeful,
‫and I will see you in the next lecture.