AWS deployment error index

IDENTITY AND CREDENTIALS

Identity, OIDC, and credential errors

• Not authorized to perform: sts:AssumeRoleWithWebIdentity — GitHub Actions OIDC trust-policy rejection.
• The security token included in the request is expired (ExpiredToken) — stale sessions, short OIDC durations, and clock skew.
• The security token included in the request is invalid (UnrecognizedClientException) — stale AWS_* variables and wrong-account keys, distinct from expiry.
• no basic auth credentials — unauthenticated Docker push to Amazon ECR.
• Access denied with an explicit deny — an SCP or Deny statement blocks the action; broader Allow policies cannot fix it.
• Denied because no policy allows it — the implicit deny: grant the exact action in the layer the error names.
• Not authorized to perform a tagging action — grant the exact tag mutation directly or alongside the create or update action that requires it.
• Value at 'tags.N.member.key' failed to satisfy constraint — the reserved aws: prefix and the tag character and length limits.
• Lambda does not have permission to access the ECR image — the repository policy gating the Lambda service's own pull.
• Lambda was unable to configure access to your environment variables — read the KMS Exception: inside the wrapper: key policy, disabled key, or wrong-Region ARN.
• Parameters: [ssm:/path] cannot be found — dynamic references resolve in the target account and Region, not where you wrote the template.
• Unable to get ID Token — the id-token: write permission the OIDC credentials step needs.
• Incorrect token audience (InvalidIdentityToken) — a token minted for a different consumer than STS expects.
• No OpenIDConnect provider found in your account — the per-account IAM registration OIDC deploys need first.
• Has prohibited field Resource — a permissions-policy statement pasted into a trust policy.
• AccessDenied / is not authorized to perform — extracting the action, principal, and policy layer before touching any policy.

CLOUDFORMATION STACK STATES

Stack lifecycle errors

• CREATE_FAILED / UPDATE_FAILED — finding the first real failure under the rollback noise.
• Embedded stack was not successfully created/updated — why the real cause lives in the child stack's own events, not the parent's.
• ROLLBACK_IN_PROGRESS / ROLLBACK_FAILED — what each rollback state means and where it lands.
• Stack is in ROLLBACK_COMPLETE state and can not be updated — the failed-first-deploy dead end.
• DELETE_FAILED — non-empty buckets, lingering ENIs, nested stacks, and cross-stack imports.
• Requires capabilities : [CAPABILITY_IAM] (InsufficientCapabilitiesException) — the IAM acknowledgement gate.
• An error occurred (Throttling): Rate exceeded — per-account API rate limits, usually from CI fan-out.
• No changes to deploy / No updates are to be performed — the empty change set that fails CI on purpose.
• Resource did not stabilize (NotStabilized) — the wait-window wrapper around a slower or nested failure.
• Export cannot be updated/deleted as it is in use — cross-stack import pins and the staged migration out of them.
• Stack is in UPDATE_IN_PROGRESS state and can not be updated (OperationInProgressException) — two deployments racing on one stack.
• S3 error: Access Denied (deployment bucket) — the artifact bucket rejecting the upload or the readback.
• BucketAlreadyExists / BucketAlreadyOwnedByYou — a globally taken S3 bucket name in the template.
• Cannot be deleted while TerminationProtection is enabled — the deliberate guard on production stacks, and the two-step disarm.
• Rollback could not delete an IAM role — out-of-band policy attachments stalling the rollback in ROLLBACK_FAILED.
• UPDATE_ROLLBACK_FAILED — the rollback itself stuck, and the continue-or-skip recovery.
• Access denied by S3 for a Lambda layer artifact — the layer ContentUri CloudFormation cannot read back.
• InvalidBucketName — an illegal bucket name, often produced by a !Sub at deploy time.

BUILD AND TEMPLATE

Build and template errors

• Cannot connect to the Docker daemon — container builds without a reachable Docker daemon.
• pull access denied / manifest unknown — the daemon replied, so it is running: the registry refused, or the tag is not there.
• no space left on device (ENOSPC) — container layers, restored caches, and the runner's preinstalled toolchains.
• Esbuild Failed: Cannot find esbuild — the bundler missing from the function project or runner.
• The REST API doesn't contain any methods — API Gateway deployment/method ordering races.
• InvalidSamDocumentException / property not defined for resource type — template schema validation before any resource exists.
• every Fn::GetAtt object requires two non-empty parameters — a malformed resource-and-attribute pair in the submitted template.
• Template exceeds a size or count quota — the 51,200-byte inline body limit and the 500-resource cap.
• Unzipped size must be smaller than 262144000 bytes — the per-function package ceilings and the container-image escape hatch.
• Code storage limit exceeded (CodeStorageExceededException) — the regional quota that months of retained versions quietly fill.
• ReservedConcurrentExecutions decreases UnreservedConcurrentExecution below its minimum value — the account-wide concurrency floor a fresh account often can't clear.
• Deploy this changeset? [y/N] hangs CI — the interactive confirmation step in a pipeline with no keyboard.
• Unable to upload artifact referenced by CodeUri — deploy-before-build and wrong-directory failures.
• CORS preflight conflicts with an existing OPTIONS method — preflight defined twice on the same path.
• PythonPipBuilder:ResolveDependencies failed — pins, runtimes, and private indexes pip cannot satisfy.
• Binary validation failed for python — the build machine missing the interpreter the template names.
• Cannot use both --resolve-s3 and --s3-bucket — samconfig.toml and the pipeline each supplying a bucket source.
• Binary validation failed: failed to build wheel — compiled dependencies without a matching wheel or toolchain.
• Code signing is not supported for container images — a zip-era CodeSigningConfig riding along on an image function.
• property not defined for resource of type — one named property on the wrong resource type.
• Failed to create changeset / Unable to locate credentials — configuration failures before any resource exists.

ONE COMMAND

Diagnose any of these automatically

SAM Doctor matches these errors — and the rest of its rule catalog — against your deployment log locally, with redacted evidence and safe verification steps. No AWS access, no log upload.

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

Hit a failure that is not listed here or not matched by the CLI? Request a diagnostic rule with a short sanitized excerpt.