Unauthorized. Access to requested resource is denied

[gwilburn68]

@khanakia

I posed this question on another thread which is now closed...

I am also getting this error. Migrating from MWS, so I followed the setup process as outlined in dev guide (and in your previous responses). In Postman (and using my code) I am able to

1. Get an LWA access token
2. Use the access token to assume selling partner role using STS

But when I use the Access Key, Secret Key, Session Token from the assumeRole and Access Token to hit the Restricted Data Token. I get:
{
"errors": [
{
"message": "Access to requested resource is denied.",
"code": "Unauthorized",
"details": ""
}
]
}
This is a Private (Internal) Developer Application
I can currently access PII using the MWS API
I had to write my own signing software (I'm on an IBM i system and cannot use the SDKs)
I had updated my profile to add "Tax" access and now my "Developer Registration is Under Review"
My App ID is in Draft status and is associated with my user ARN

I have a case open with Amazon currently

Any suggestions?

[khanakia]

@gwilburn68 You can try this https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/

[gwilburn68]

@gwilburn68 You can try this https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/

Thanks. I can give that a try. Does this also log calls to the sellingpartner-na endpoints?

[khanakia]

As far i know it will only log authorization error. But you can give it a try.

[gwilburn68]

As far i know it will only log authorization error. But you can give it a try.

So I stumbled through the setup. I then ran my Postman collection:

1. Get Access Token: //api.amazon.com/auth/o2/token
2. Assume Role: //sts.amazonaws.com/
3. Get Restricted Data Token: //sellingpartnerapi-na.amazon.com/tokens/2021-03-01/restrictedDataToken

The only thing I can find in the logging is step #671 above. I ran a query doing "Select * from myfile". I could see a bunch of entries, but could not match up the User Agent I'm using or the reqeust ID's returned from the various APIs.

It did not log any of the other calls (including the one in error).

No idea where to go now.

[khanakia]

@gwilburn68 Did you check this #1255 ?

[gwilburn68]

@khanakia This was it... Amazon's stupid instructions doesn't tell me I need to NOT create the ARN Role and NOT use it when I have my App registered with the ARN USER.
#943
Support finally got back to me to tell me this. I do not need to use the assumeRole on STS to get temporary access key and secret key.

I also got my App approved today - so that may have helped to.

Thank you for your help!

[Adrian-T-AMZN]

Hello @gwilburn68,

Thank you for reaching out regarding the Access Denied error Migrating from MWS.

I see that developer support has provided you with the solution for this issue, which is not using the assumeRole on STS to get temporary access key and secret key when your app is associated to an IAM User.

This instruction can actually be found on our documentation: https://developer-docs.amazon.com/sp-api-blog/docs/migrate-seller-authorizations-from-mws-to-sp-api#step-2-generate-temporary-credentials-using-aws-security-token-service-aws-sts

If the information available in the documentation link provided above does not fully resolve your inquiry, please open a support case with us.

Thanks,
Adrian T.
Selling Partner API Developer Support

[supoman-service]

If you need it, you can take a look or contact me.

https://www.sellerhub.cn/archives/amazon-pii-question