aws-amplify / aws-amplify/amplify-hosting
Misleading error message when performing "DeleteBackendEnvironment" operation by an unauthorized user
- Dominant language
- Dockerfile
- Stars
- 481
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
### Before opening, please confirm:
- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-hosting/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
### App Id
_No response_
### Region
_No response_
### Amplify Hosting feature
_No response_
### Describe the bug
When trying to delete Amplify backend environment from console by signing in as a user who is not authorised to perform the action. Console shows the below error message
> "Deletion Failed Network Failed"
It ideally should display Unauthorised/AccessDenied error.
In the browser console, the remove network call is failing with 403 error. That is as below, however the console shows the Network Failed error.
> x-amzn-errortype: AccessDeniedException
Also, could see AccessDenied error in CloudTrail logs.
### Expected behavior
Console should be showing an accurate error message like AccessDenied/Unauthorised.
### Reproduction steps
1. Created an IAM user without the “DeleteBackendEnvironment” permission.
2. Signed as this user and tried to delete an amplify backend environment from the console.
3. The delete operation failed with the below error message
> “Deletion Failed Network Failed"
4. Checked the network calls being made from the browser and could see the 'remove' call failing with 403.
5. Also, the CloudTrail logs show the AccessDenied error.
### Build Settings
_No response_
### Additional information
_No response_
Contributor guide
Research direction
Start in the Amplify Hosting console flow for the DeleteBackendEnvironment operation and trace the remove network call when it returns HTTP 403 with AccessDeniedException. Done means an unauthorized user sees an AccessDenied or Unauthorized message instead of “Deletion Failed Network Failed”; the issue names no files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100