---
name: vpc-file_storage_vpc_troubleshoot
title: Why do my file share operations fail with a 'shares_access_forbidden' error?
description: Resolve 'shares_access_forbidden' errors caused by context-based restriction (CBR) configuration issues during file share operations.
last-updated: 2026-06-26
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/vpc?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Why do my file share operations fail with a 'shares_access_forbidden' error?
{: #troubleshooting-file-storage}
{: troubleshoot}
{: support}

Resolve 'shares_access_forbidden' errors caused by context-based restriction (CBR) configuration issues during file share operations.
{: shortdesc}

A `shares_access_forbidden` error occurs when the context-based restriction (CBR) feature is used during file share operations, such as creating or updating a file share. In this case, the user request is forbidden, which is not the expected behavior.
{: tsSymptoms}

An issue exists with the [IAM CBR feature](https://cloud.ibm.com/docs/iam?topic=iam-context-restrictions-whatis&format=markdown). Because the file service depends on the Cloud Identity and Access Management CBR, share operations result in an error.
{: tsCauses}

An error occurs after you set up CBR by [creating a network zone](https://cloud.ibm.com/docs/vpc?topic=vpc-cbr&interface=ui&format=markdown#network-zone) and a [context-based rule](https://cloud.ibm.com/docs/vpc?topic=vpc-cbr&interface=ui&format=markdown#cbr-rules), and then try to perform a file share operation.

1. Add `shares` service to a network zone.
    ```sh
    ibmcloud cbr zone-create --name network-zone-1 --description "Example zone 1" --addresses 198.51.100.0  --vpc VPC-1 --service-ref service_name=shares
    ```
    {: pre}

2. Create a context-based rule and specify `shares` as the service name and share ID for resource attributes.
    ```sh
    ibmcloud cbr rule-create --zone-id a7eeb5dd8e6bdce670eba1afce18e37f --description "Test CBR for file share" --service-name shares --resource-attributes "shareId=UUID-OF-SHARE"
    ```
    {: pre}

    For more information about these commands, see the [CBR CLI reference](https://cloud.ibm.com/docs/iam?topic=iam-cbr-plugin&format=markdown).

3. The error occurs when you attempt to create a file share after CBR is enabled. For example, when you use the [VPC API](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-create&interface=api&format=markdown#fs-create-file-share-api) to create the share, you get the following error message in the response:

```json
{
    "errors": {
      {
          "code": "shares_access_forbidden",
          "message": "The user request is forbidden",
          "more_info": "The user is forbidden to access the requested resource. Check permissions and try again."
      }
   }
}
```
{: screen}

This error requires that you contact [IBM support](https://cloud.ibm.com/docs/support?topic=support-open-case&format=markdown). Provide the error logs for their reference.
{: tsResolve}