title: boto3 giving AccessDenied, is there a way to lookup the missing permissions?
body: <p>I've been trying to figure out why this step in my script isn't working, as far as I know, my user has permissions to do everything on our AWS account, so I'm a bit confused. I was wondering if there was a way you could get a return from botocore or boto3 itself identifying the missing iam permission for your user rather than figure out exactly the right permissions for the job you need to do it yourself?</p>
  
  <p>Initially I had zone_id configured <a href="http://docs.aws.amazon.com/general/latest/gr/rande.html#elasticbeanstalk_region" rel="nofollow noreferrer">from here</a></p>
  
  <pre><code>&gt;&gt;&gt; dns_record = connection.change_resource_record_sets(
  ...     HostedZoneId=zone_id,
  ...     ChangeBatch={
  ...         'Changes': [
  ...             {
  ...                 'Action': action,
  ...                 'ResourceRecordSet': {
  ...                     'Name': name,
  ...                     'Type': record_type,
  ...                     'TTL': 60,
  ...                     'AliasTarget': {
  ...                         'HostedZoneId': zone_id,
  ...                         'DNSName': destination,
  ...                         'EvaluateTargetHealth': eval_health
  ...                     },
  ...                 }
  ...             },
  ...         ]
  ...     }
  ... )
  
  Traceback (most recent call last):
    File "&lt;stdin&gt;", line 14, in &lt;module&gt;
    File "/usr/lib/python2.7/site-packages/botocore/client.py", line 253, in _api_call
      return self._make_api_call(operation_name, kwargs)
    File "/usr/lib/python2.7/site-packages/botocore/client.py", line 543, in _make_api_call
      raise error_class(parsed_response, operation_name)
  botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the ChangeResourceRecordSets operation: User: arn:aws:iam::1337:user/rumbles is not authorized to access this resource
  &gt;&gt;&gt; 
  &gt;&gt;&gt; print connection, zone_id, action, name, record_type, destination, eval_health
  &lt;botocore.client.Route53 object at 0x7f9049d64590&gt; Z117KPS5GTRQ2G UPSERT test-rumbles.domain.com A some-elb-1337.us-east-1.elb.amazonaws.com False
  </code></pre>
  
  <p>If I change zone_id to the Zone of our AWS domain I get:</p>
  
  <pre><code>&gt;&gt;&gt; zone_id = "Z2401337RNHANU"
  &gt;&gt;&gt; 
  &gt;&gt;&gt; try:
  ...
  An error occurred (InvalidInput) when calling the ChangeResourceRecordSets operation: Invalid request
  {'ResponseMetadata': {'RetryAttempts': 0, 'HTTPStatusCode': 400, 'RequestId': '2bfde962-0e81-11e7-b312-53961dec3e91', 'HTTPHeaders': {'x-amzn-requestid': '2bfde962-0e81-11e7-b312-53961dec3e91', 'date': 'Tue, 21 Mar 2017 21:56:00 GMT', 'content-length': '259', 'content-type': 'text/xml', 'connection': 'close'}}, 'Error': {'Message': 'Invalid request', 'Code': 'InvalidInput', 'Type': 'Sender'}}
  </code></pre>
  
  <p>I've had to look in to these issues before, I know that I just have to find the right IAM permission for this particular job (assuming I am on the right path), but I was wondering if there is some way to get this information returned from botocore? Rather than spending my time manually having to look it up, can't I get the iam rule that denied me access returned by my except somehow?</p>
  
  <p>Or am I talking about a feature request I haven't found/created yet?</p>