From 49ec838f357bfdb6cf65d17be080ebcb6ded6afa Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 23 Oct 2025 15:04:31 +0400
Subject: [PATCH] fix(aws-auth): better error logging

---
 .../identity-aws-auth/identity-aws-auth-service.ts   | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
index 1814afb2e..3aadc6b4a 100644
--- a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
+++ b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
@@ -21,6 +21,7 @@ import {
   UnauthorizedError
 } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
+import { logger } from "@app/lib/logger";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -147,6 +148,8 @@ export const identityAwsAuthServiceFactory = ({
     if (identityAwsAuth.allowedPrincipalArns) {
       // validate if Arn is in the list of allowed Principal ARNs
 
+      const formattedArn = extractPrincipalArn(Arn);
+
       const isArnAllowed = identityAwsAuth.allowedPrincipalArns
         .split(",")
         .map((principalArn) => principalArn.trim())
@@ -155,13 +158,16 @@ export const identityAwsAuthServiceFactory = ({
           // considers exact matches + wildcard matches
           // heavily validated in router
           const regex = new RE2(`^${principalArn.replaceAll("*", ".*")}$`);
-          return regex.test(extractPrincipalArn(Arn));
+          return regex.test(formattedArn);
         });
 
-      if (!isArnAllowed)
+      if (!isArnAllowed) {
+        logger.info({ formattedArn, rawArn: Arn }, "Access denied: AWS principal ARN not allowed");
+
         throw new UnauthorizedError({
-          message: "Access denied: AWS principal ARN not allowed."
+          message: `Access denied: AWS principal ARN not allowed. [principal-arn=${formattedArn}]`
         });
+      }
     }
 
     const identityAccessToken = await identityAwsAuthDAL.transaction(async (tx) => {