Fixing AWS Performance Insights API NotAuthorizedException Error

Problem Statement

I'm encountering an error while running Performance Insights CLI commands or making API calls via Python. My account has the AdministratorAccess AWS-managed policy, and I can successfully execute CLI commands and API calls for other AWS services without issues.

When executing the following AWS CLI command:

aws pi get-resource-metrics \
    --service-type RDS \
    --identifier database-1 \
    --metric-queries '[{"Metric": "db.load.avg"}]' \
    --start-time $(date -u -d '-5 minutes' +%Y-%m-%dT%H:%M:%SZ) \
    --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
    --region us-west-1

The following error occurs:

An error occurred (NotAuthorizedException) when calling the GetResourceMetrics operation: The specified resource is not authorized for this account

Solution:-

1. Ensure Performance Insights is Enabled

Run the following command to check if Performance Insights is enabled for your RDS instance:

aws rds describe-db-instances --db-instance-identifier database-1 --region us-west-1 --query 'DBInstances[0].PerformanceInsightsEnabled'

If the output is false, allow performance insights to for your RDS instance.

2. Check IAM Permissions

Even with AdministratorAccessEnsure your IAM role has the necessary permissions:

aws iam list-attached-user-policies --user-name YOUR_USER_NAME

3. Get the `dbiResourceId`

Retrieve the correct dbiResourceId:

aws rds describe-db-instances --db-instance-identifier database-1 --region us-west-1 --query 'DBInstances[0].DbiResourceId'

Use this dbiResourceId in the --identifier field of the get-resource-metrics command.

4. Get Resource Metrics using AWS CLI

Replace the identifier dbiResourceId, then run the command to get performance insights.

aws pi get-resource-metrics \
--service-type RDS \
--identifier DBI_RESOURCE_ID \
--metric-queries '[{"Metric": "db.load.avg"}]' \
--start-time $(date -u -d '2 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
--end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
--period-in-seconds 60 \
--region us-west-1

5. Check Performance Insights Data Availability Using Python Script

import boto3
from datetime import datetime, timedelta

def get_rds_performance_insights_metrics(db_instance_identifier, region_name, metric_name, period_seconds=60, minutes_ago=30):
    """
    Retrieves RDS Performance Insights metrics using the DbiResourceId.
    """
    try:
        rds_client = boto3.client('rds', region_name=region_name)
        pi_client = boto3.client('pi', region_name=region_name)

        response = rds_client.describe_db_instances(DBInstanceIdentifier=db_instance_identifier)
        dbi_resource_id = response['DBInstances'][0]['DbiResourceId']

        end_time = datetime.utcnow()
        start_time = end_time - timedelta(minutes=minutes_ago)

        response = pi_client.get_resource_metrics(
            ServiceType='RDS',
            Identifier=dbi_resource_id,
            MetricQueries=[{'Metric': metric_name}],
            StartTime=start_time,
            EndTime=end_time,
            PeriodInSeconds=period_seconds
        )

        return response

    except Exception as e:
        print(f"Error: {e}")
        return None

# Example usage
db_instance_id = 'database-1'
region = 'us-west-1'
metric = 'db.load.avg'

metrics_data = get_rds_performance_insights_metrics(db_instance_id, region, metric)

if metrics_data:
    print(metrics_data) #print the full response.
    for metric_list in metrics_data['MetricList']:
        print(f"Metric: {metric_list['Key']['Metric']}")
        #Correct the key to DataPoints.
        for data_point in metric_list['DataPoints']:
            timestamp = data_point['Timestamp']
            value = data_point.get('Value', None) #safely get value.
            print(f"  Timestamp: {timestamp}, Value: {value}")

Conclusion

Following these steps should help identify and resolve the issue with AWS Performance Insights API calls. If problems persist, check AWS CloudTrail logs for failed API calls or contact AWS Support.

Fixing AWS Performance Insights API NotAuthorizedException Error: A Complete Guide

Comments

Ops Fix Hub

Optimize GCS Costs with Python: Intelligent Storage Class Recommendations

More from this blog

Cost Optimization with Planned Downtime Migrating an EBS-Backed StatefulSet from Multi-AZ to Single-AZ in Amazon EKS (Production Pattern)

From Provisioning to Control Plane: Designing a Hybrid Terraform + Crossplane Architecture at Scale

Cross-Cloud VM Migration: GCP → AWS Using AWS Application Migration Service (MGN)

AWS DevOps Agent: Real Testing, Architecture & Practical Insights

Production-Grade GCS to S3 Migration: Secure, Private, and Zero-Egress Architecture

Problem Statement

Solution:-

1. Ensure Performance Insights is Enabled

2. Check IAM Permissions

3. Get the `dbiResourceId`

4. Get Resource Metrics using AWS CLI

5. Check Performance Insights Data Availability Using Python Script

Conclusion

Command Palette

Comments

Ops Fix Hub

Optimize GCS Costs with Python: Intelligent Storage Class Recommendations

More from this blog

Problem Statement

Solution:-

1. Ensure Performance Insights is Enabled

2. Check IAM Permissions

3. Get the dbiResourceId

4. Get Resource Metrics using AWS CLI

5. Check Performance Insights Data Availability Using Python Script

Conclusion

3. Get the `dbiResourceId`