Docs / Team and security
Cloud permission errors
Resolve missing AWS, Google Cloud or Azure permissions with an authorized administrator.
Pangea never widens a connector's cloud permissions on its own. There is no permission-admin role and no grant request to approve. When the agent hits a missing permission, an authorized administrator fixes it in the cloud.
Resolve an access error
- Check the account, project or subscription, and the identity the agent used. A wrongly selected connector can look like a missing permission.
- Ask the agent to name the denied operation, the exact missing permission, the affected resource and the narrowest policy change. If the credential has expired, refresh it before you change IAM.
- Have an authorized administrator apply that scoped change in the cloud console. Or ask the agent to use a selected computer whose local cloud CLI is already signed in with the right administration rights. The agent must check that CLI's account and identity first.
- Retry the original operation with refreshed connector credentials.
A temporary session can restrict an AWS role further, but it can't grant an action that is missing from the role's own policy. Don't fix this by giving the operational connector permission to widen itself.
Remove access you no longer need
Removing a connection in Connectors stops Pangea from using it. It does not remove the cloud identity or its policies. Revoke unneeded IAM access in the cloud too.
See Access control, IAM trust model and Auto Mode and Full Access for the separate controls on who can use a connector and which runtime actions ask for approval.