diff --git a/nova/api/openstack/compute/contrib/attach_interfaces.py b/nova/api/openstack/compute/contrib/attach_interfaces.py
index 21bf4fb90a15..da2265434ffd 100644
--- a/nova/api/openstack/compute/contrib/attach_interfaces.py
+++ b/nova/api/openstack/compute/contrib/attach_interfaces.py
@@ -70,6 +70,8 @@ class InterfaceAttachmentController(object):
             port_info = self.network_api.show_port(context, port_id)
         except exception.NotFound as e:
             raise exc.HTTPNotFound(explanation=e.format_message())
+        except exception.Forbidden as e:
+            raise exc.HTTPForbidden(explanation=e.format_message())
 
         if port_info['port']['device_id'] != server_id:
             msg = _("Instance %(instance)s does not have a port with id"
diff --git a/nova/api/openstack/compute/plugins/v3/attach_interfaces.py b/nova/api/openstack/compute/plugins/v3/attach_interfaces.py
index fa09b8a22ee1..523d1b1b4e22 100644
--- a/nova/api/openstack/compute/plugins/v3/attach_interfaces.py
+++ b/nova/api/openstack/compute/plugins/v3/attach_interfaces.py
@@ -60,7 +60,7 @@ class InterfaceAttachmentController(object):
         return self._items(req, server_id,
             entity_maker=_translate_interface_attachment_view)
 
-    @extensions.expected_errors(404)
+    @extensions.expected_errors((403, 404))
     def show(self, req, server_id, id):
         """Return data about the given interface attachment."""
         context = req.environ['nova.context']
@@ -74,8 +74,10 @@ class InterfaceAttachmentController(object):
 
         try:
             port_info = self.network_api.show_port(context, port_id)
-        except exception.NotFound:
-            raise exc.HTTPNotFound()
+        except exception.NotFound as e:
+            raise exc.HTTPNotFound(explanation=e.format_message())
+        except exception.Forbidden as e:
+            raise exc.HTTPForbidden(explanation=e.format_message())
 
         if port_info['port']['device_id'] != server_id:
             raise exc.HTTPNotFound()
diff --git a/nova/tests/api/openstack/compute/contrib/test_attach_interfaces.py b/nova/tests/api/openstack/compute/contrib/test_attach_interfaces.py
index aa98ffb7cbda..e71b3544f39a 100644
--- a/nova/tests/api/openstack/compute/contrib/test_attach_interfaces.py
+++ b/nova/tests/api/openstack/compute/contrib/test_attach_interfaces.py
@@ -198,6 +198,19 @@ class InterfaceAttachTestsV21(test.NoDBTestCase):
                           self.attachments.show, req, FAKE_UUID2,
                           FAKE_PORT_ID1)
 
+    @mock.patch.object(network_api.API, 'show_port',
+                       side_effect=exception.Forbidden)
+    def test_show_forbidden(self, show_port_mock):
+        req = webob.Request.blank(self.url + '/show')
+        req.method = 'POST'
+        req.body = jsonutils.dumps({})
+        req.headers['content-type'] = 'application/json'
+        req.environ['nova.context'] = self.context
+
+        self.assertRaises(exc.HTTPForbidden,
+                          self.attachments.show, req, FAKE_UUID1,
+                          FAKE_PORT_ID1)
+
     def test_delete(self):
         self.stubs.Set(compute_api.API, 'detach_interface',
                        fake_detach_interface)