{
"fault": {
"faultstring": "Access Denied for client ip : client_IP",
"detail": {
"errorcode": "accesscontrol.IPDeniedAccess"
}
}
}
오류 메시지 예
{
"fault": {
"faultstring": "Access Denied for client ip : 104.132.196.83",
"detail": {
"errorcode": "accesscontrol.IPDeniedAccess"
}
}
}
원인
이 오류는 클라이언트 IP 주소 또는 API 요청의 일부로 전달된 IP 주소가 액세스 제어 정책의 <MatchRule> 요소 내 <SourceAddress> 요소에 지정된 IP 주소와 일치하며 <MatchRule> 요소의 action 속성이 DENY로 설정된 경우에 발생합니다.
API 요청이 전송된 IP 주소를 확인합니다. 다음과 같은 여러 가지 방법으로 이 작업을 수행할 수 있습니다.
UI Trace 사용
실패한 API 요청의 trace를 캡처합니다.
오른쪽 패널에서 실패한 특정 액세스 제어 정책을 선택합니다.
Phase Details(단계 세부정보) 창에서 다음 샘플 trace 스크린샷과 같이 proxy.client.ip 변수의 값을 확인합니다.
proxy.client.ip가 나열되지 않았으면 X-Forwarded-For 또는 True-Client-IP 메시지 헤더의 값을 확인합니다.
커스텀 보고서 사용
커스텀 보고서를 만들어 API 프록시 내에서 액세스 제어 정책을 실행하는 동안 403 상태 코드가 발생했는지 확인하고 클라이언트 IP 주소도 확인할 수 있습니다. 이 방법은 문제가 이전에 발생한 적이 있거나 간헐적으로 발생하여 UI에서 trace를 캡처할 수 없는 경우에 특히 유용합니다.
커스텀 보고서를 만드는 방법을 알아보려면 커스텀 보고서 만들기 및 관리를 참조하세요. 커스텀 보고서에서 다음을 선택합니다.
Metric(측정항목)에서 Sum of Traffic(트래픽의 합계)
Dimensions(측정기준)에서 Proxy(프록시), Response Status Code(응답 상태 코드), Proxy Client IP(프록시 클라이언트 IP), X-Forwarded-For-IP
그러면 오류의 원인이 된 전달된 클라이언트 IP 또는 IP 주소를 확인할 수 있습니다.
액세스 제어 정책의 <MatchRule> 요소 내 <SourceAddress> 요소에 지정된 IP 주소(action 속성이 DENY로 설정됨)와 일치하는 클라이언트 IP 주소(proxy.client.ip 변수로 표시됨) 또는 API 요청의 일부로 전달된 IP 주소가 오류의 원인입니다.
위의 예시에서는 참조 변수 proxy.client.ip에 설정된 값(위의 trace 스크린샷에 표시됨)이 액세스 제어 정책의 <SourceAddress> 요소에 정의된 IP 주소와 일치하므로 오류 응답을 트리거합니다.
"faultstring": "Access Denied for client ip : 104.132.196.83"
해결 방법
액세스 제어 정책이 faultstring에 나열된 특정 IP 주소로부터 수신되는 API 요청에 대해 액세스를 거부하는 것이라면 오류 메시지가 표시됩니다. 이 경우에는 추가 작업이 필요하지 않습니다.
그러나 특정 IP 주소에 특정 API 프록시의 API 요청에 대한 액세스 권한을 부여할 수 있다고 판단되면 액세스 제어 정책을 수정하여 해당 IP 주소의 액세스를 허용하세요. 또는 모든 IP 주소의 액세스를 거부하지 않으려면 API 프록시에서 액세스 제어 정책을 삭제하면 됩니다.
다음 예시에서는 특정 IP 주소(104.132.196.83)에만 액세스를 허용하고 나머지는 액세스를 거부하는 방법을 보여줍니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[[["\u003cp\u003eThis documentation pertains to the \u003ccode\u003eaccesscontrol.IPDeniedAccess\u003c/code\u003e error in Apigee and Apigee hybrid, which occurs when a client IP is denied access by an Access Control Policy.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eaccesscontrol.IPDeniedAccess\u003c/code\u003e error is triggered when the client's IP address, or an IP passed in the request, matches an IP in the \u003ccode\u003e<SourceAddress>\u003c/code\u003e element within the \u003ccode\u003e<MatchRule>\u003c/code\u003e of an Access Control Policy with the \u003ccode\u003eaction\u003c/code\u003e attribute set to \u003ccode\u003eDENY\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eTo diagnose the issue, identify the denied IP address from the \u003ccode\u003efaultstring\u003c/code\u003e in the error response, and locate the corresponding Access Control Policy where the IP is listed in the \u003ccode\u003e<SourceAddress>\u003c/code\u003e element.\u003c/p\u003e\n"],["\u003cp\u003eThe source IP address can be determined by examining the \u003ccode\u003eproxy.client.ip\u003c/code\u003e variable in a UI Trace or by creating a custom report that includes Proxy, Response Status Code, Proxy Client IP, and X-Forwarded-For-IP as dimensions.\u003c/p\u003e\n"],["\u003cp\u003eResolving this error involves either confirming the intended denial of access or modifying the Access Control Policy to allow the specific IP address by changing the \u003ccode\u003eaction\u003c/code\u003e to \u003ccode\u003eALLOW\u003c/code\u003e or removing the Access Control Policy altogether.\u003c/p\u003e\n"]]],[],null,["# AccessControl policy runtime error troubleshooting\n\n*You're viewing **Apigee** and **Apigee hybrid** documentation.\nView [Apigee Edge](https://docs.apigee.com/api-platform/troubleshoot/policies/runtime/access-control-runtime-errors) documentation.*\n| **Note:** Was this troubleshooting playbook helpful? Please let us know by clicking [Send Feedback]().\n\nIPDeniedAccess\n--------------\n\n### Error code\n\n accesscontrol.IPDeniedAccess\n\n### Error response body\n\n```scdoc\n{\n \"fault\": {\n \"faultstring\": \"Access Denied for client ip : client_IP\",\n \"detail\": {\n \"errorcode\": \"accesscontrol.IPDeniedAccess\"\n }\n }\n}\n```\n\n### Example error message\n\n {\n \"fault\": {\n \"faultstring\": \"Access Denied for client ip : 104.132.196.83\",\n \"detail\": {\n \"errorcode\": \"accesscontrol.IPDeniedAccess\"\n }\n }\n }\n\n### Cause\n\nThis error occurs if the client IP address, or any IP address passed as part of the API request, matches any IP address(es) specified in the `\u003cSourceAddress\u003e` element within the `\u003cMatchRule\u003e` element of the Access Control Policy, and the `action` attribute of the `\u003cMatchRule\u003e` element is set to `DENY`.\n\nFor example, let's say the `\u003cSourceAddress\u003e` is defined as shown below: \n\n \u003cSourceAddress mask=\"32\"\u003e104.132.196.83\u003c/SourceAddress\u003e\n\nIf the above IP address matches the IP address of the client system (indicated by the variable `proxy.client.ip`), or any of the IP addresses passed as part of the API request, the error will occur.\n\n### Diagnosis\n\n1. Identify the IP address(es) denied access for a specific API request. You can find this information in the `faultstring` element of the error response.\n\n For example, in the following `faultstring`, the IP address is `104.132.196.83:` \n\n \"faultstring\": \"Access Denied for client ip : 104.132.196.83\"\n\n2. Examine all the Access Control policies in the failed API Proxy and determine the specific policy where the IP address(es) specified in the `\u003cSourceAddress\u003e` element matches the IP address(es) identified in the `faultstring` (Step 1 above).\n\n For example, the following policy defines the `\u003cSourceAddress\u003e` IP as `104.132.196.83,` which matches what is in the `faultstring`: \n\n \u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\n \u003cAccessControl async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"Access-Control\"\u003e\n \u003cDisplayName\u003eAccess-Control\u003c/DisplayName\u003e\n \u003cProperties/\u003e\n \u003cIPRules noRuleMatchAction=\"ALLOW\"\u003e\n \u003cMatchRule action=\"DENY\"\u003e\n \u003cSourceAddress mask=\"32\"\u003e104.132.196.83\u003c/SourceAddress\u003e\n \u003c/MatchRule\u003e\n \u003c/IPRules\u003e\n \u003c/AccessControl\u003e\n\n3. Determine the IP address(es) from which the API request was made. This can be done in multiple ways:\n\n 1. Using UI Trace\n\n 1. Capture the trace for the failing API request.\n 2. Select the specific Access Control Policy that has failed from the right hand panel.\n 3. In the **Phase Details** pane, check the value of the variable `proxy.client.ip` as shown in the following screenshot of a sample trace.\n\n 4. If the `proxy.client.ip` is not listed, then check the value of the\n X-Forwarded-For or True-Client-IP message headers.\n\n 2. Using Custom Reports\n\n You can create Custom Reports to determine whether a 403 status code was thrown during the execution of the Access Control policy within the API proxy and also determine the client IP address. This is particularly useful if the issue has occurred in the past or if the issue is intermittent and you are unable to capture the trace in UI.\n\n Refer to [Creating and managing custom reports](/apigee/docs/api-platform/analytics/create-custom-reports) to understand how to create custom reports. In the custom report, choose:\n 1. **Sum of Traffic** as a Metric, and\n\n 2. **Proxy** , **Response Status Code** , **Proxy Client IP** , and **X-Forwarded-For-IP** as Dimensions.\n\n This should help you to determine the client IP or IP addresses passed that led to the error.\n4. If the client IP address (indicated by the variable `proxy.client.ip`), or any IP address passed as part of the API request, matches the IP address(es) specified in the `\u003cSourceAddress\u003e` element within the `\u003cMatchRule\u003e` element of Access Control Policy, where the `action` attribute is set to `DENY`, then that is the cause of the error.\n\n In the example shown above, the value set in the reference variable `proxy.client.ip` (as seen in the screenshot of the trace above) matches the IP address defined in the `\u003cSourceAddress\u003e` element of the Access Control policy, thus triggering the error response: \n\n \"faultstring\": \"Access Denied for client ip : 104.132.196.83\"\n\n### Resolution\n\nIf the Access Control policy is intended to deny access to API requests coming from the specific IP address(es) listed in the `faultstring`, then the error message is expected. In this case, there is no additional action is required.\n\nHowever, if you determine that the specific IP address(es) can be given access to the API requests for the specific API Proxy, then modify the Access Control Policy to allow access to those IP address(es). Alternatively, you can remove the Access Control Policy from the API Proxy if you don't want to deny access to any IP address(es).\n\nHere is an example that shows how to allow access to a specific IP Address `104.132.196.83` only and deny access for the rest: \n\n \u003cAccessControl name=\"ACL\"\u003e\n \u003cIPRules noRuleMatchAction = \"DENY\"\u003e\n \u003cMatchRule action = \"ALLOW\"\u003e\n \u003cSourceAddress mask=\"32\"\u003e104.132.196.83\u003c/SourceAddress\u003e\n \u003c/MatchRule\u003e\n \u003c/IPRules\u003e\n \u003c/AccessControl\u003e"]]
