---
title: "AWS IAM Identity Center users can sign in, but why do their CLI calls get denied?"  
description: "AWS IAM Identity Center users can sign in, but why do their CLI calls get denied?"  
author: "Steilla Mitchel"  
published: 2026-10-11  
updated: 2026-10-11  
canonical: https://www.mindstick.com/forum/162256/aws-iam-identity-center-users-can-sign-in-but-why-do-their-cli-calls-get-denied  
category: "IAM Identity Center"  
tags: ["AWS IAM", "AWS CLI", "cloud security"]  
reading_time: 1 minute  

---

# AWS IAM Identity Center users can sign in, but why do their CLI calls get denied?

We’ve set up AWS IAM Identity Center for our team. People can sign in through the access portal and select the right account, but some AWS CLI commands still return `AccessDenied`.

I’m trying to narrow down whether the issue is usually the [permission set](https://www.mindstick.com/forum/34356/facebook-email-field-return-null-even-if-the-email-permission-is-set-and-accepted), an account-level policy, or how the CLI profile was configured. What do you check first when console access works but [command-line access](https://www.mindstick.com/forum/160704/how-to-pass-or-access-command-line-arguments-in-c) does not? We have several accounts and would like to avoid handing out broader permissions just to make the errors disappear.


---

Original Source: https://www.mindstick.com/forum/162256/aws-iam-identity-center-users-can-sign-in-but-why-do-their-cli-calls-get-denied

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.