2

I am using AWS transcription API on Node JS with following code

const tClient = new TranscribeClient({
        region: "us-east-1",
        credentials: {
            accessKeyId: AWS_ID,
            secretAccessKey: SECRET,
        }
    });

    const params = {
        TranscriptionJobName: "firstjob",
        LanguageCode: "en-US", // For example, 'en-US'
        MediaFormat: "m4a", // For example, 'wav'
        Media: {
          MediaFileUri: "https://transcribe-demo.s3-REGION.amazonaws.com/hello_world.m4a",
       
        },
      };

     const run = async () => {
        try {
          const data = await tClient.send(
            new StartTranscriptionJobCommand(params)
          );
          console.log("Success - put", data);
          return data; // For unit tests.
        } catch (err) {
          console.log("Error", err);
        }
    };
    run();

But I am getting following error, I have checked all the permissions and access keys are correct . I am unable to understand error reason.

AccessDeniedException: User: arn:aws:iam::494240200407:user/demno_system is not authorized to perform: transcribe:StartTranscriptionJob on resource: arn:aws:transcribe:us-east-1:494240200407:transcription-job/firstjob because no permissions boundary allows the transcribe:StartTranscriptionJob action

Any inputs are appreciated.

vishal dharankar
  • 7,536
  • 7
  • 57
  • 93
  • The permissions are not in fact correct. Please post the policy (or policies) for the IAM user. – gshpychka Apr 04 '22 at 17:49
  • As gshpychka suggested, can you check the permissions boundary? In the console under IAM > Users or Roles > Permissions tab, there are 2 sub-sections: permissions and permissions boundary. If only the permissions allow transcription, but not the permissions boundary, you will get access denied. And based on your S3 example, likely the permissions boundary allows S3 upload/download. – Register Sole Apr 08 '22 at 01:00

1 Answers1

1

As stated in the error message, you have a permission boundary that doesn't allow this action. The fact that you added the required policy to the user has no effect, since the access is limited by the permission boundary. You need to edit the user's permission boundary to allow this.

Refer to the documentation.

gshpychka
  • 8,523
  • 1
  • 11
  • 31