ERROR REFERENCE
Access denied: with an explicit deny
AWS evaluated the request and found a Deny statement that matched it. An explicit deny always wins — adding or broadening Allow policies cannot fix this. The only fix is finding and amending the Deny itself.
WHAT IT MEANS
What this error means
The message reads like a generic permission failure, but the
with an explicit deny (or due to an explicit
deny) suffix changes everything: some policy affirmatively
blocks this action. The Deny lives in one of the layers that apply to
the caller:
- A service control policy from the AWS Organizations management account — the error says so when it is the cause:
with an explicit deny in a service control policy. Member accounts can neither see nor change SCPs. - A Deny statement in the caller's identity policies, permissions boundary, or session policy.
- A resource policy Deny on the target bucket, key, queue, or role.
Because Deny beats Allow in IAM evaluation, no amount of added permissions changes the outcome — which is why this failure survives every "just attach a broader role" attempt.
FIX
How to fix it
-
Record the exact action, caller, and resource from
the error, and confirm which identity actually made the call:
aws sts get-caller-identity - If the message names a service control policy: the deny comes from the AWS Organizations management account. Raise it with whoever administers the organization — from the member account it is invisible and unfixable by design.
-
Otherwise, search for matching
"Effect": "Deny"statements across the caller's identity policies, permissions boundary, session policy, and the target's resource policy. The IAM Policy Simulator confirms which layer denies. - Look up the request in CloudTrail (by request ID from the error when present) to see the full denied request context, including condition keys the Deny may key on.
-
Amend the specific Deny — add a condition or an
exception for the deployment identity. Do not broaden Allow
policies, and never attach
AdministratorAccessto work around a deny.
AUTOMATE THE TRIAGE
Diagnose this automatically
SAM Doctor separates explicit denies from ordinary missing-permission failures (high confidence) and reports the denied action and denial type from redacted evidence — no raw ARNs. Runs locally; no AWS access, no log upload.
python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdownRELATED
Related errors
- Denied because no policy allows it — the implicit-deny sibling: nothing blocks the action, but nothing grants it either.
- Not authorized to perform: sts:AssumeRoleWithWebIdentity — the OIDC trust-policy variant of "denied".
- Requires capabilities (InsufficientCapabilitiesException) — an acknowledgement gate that reads like a permission failure but is not one.