ERROR REFERENCE
AccessDenied (read the error before touching a policy)
A modern IAM denial names almost everything you need: the denied action, the principal, often the resource, and — in newer error text — which policy layer said no. The triage skill is extracting those four facts before changing anything, because each layer has a different fix.
WHAT IT MEANS
What the wording tells you
... is not authorized to perform: iam:CreateRole on resource ...— the action and target, always the starting point.... with an explicit deny in a service control policy— an organization-level block; no Allow anywhere can override it. See the explicit-deny page.... because no identity-based policy allows the action— the implicit deny; grant the action in the named layer. See the no-policy-allows page.- No layer named at all — older error text; assume the implicit deny first, it is far more common.
TRIAGE
How to triage it
-
Confirm who was actually calling (read-only):
CI denials are often the wrong role being assumed, not the right role missing a permission.aws sts get-caller-identity - Grant the exact denied action to the deploy principal in the layer the error names - and only that action; resist wildcard escalation, which trades one denial for an audit finding.
- If an SCP is named, escalate instead of editing. The block lives at the AWS Organizations level, above this account, and is usually intentional.
AUTOMATE THE TRIAGE
Diagnose this automatically
SAM Doctor parses the denied action, principal presence, resource scope, and policy layer out of the redacted evidence, and routes explicit-deny and no-policy-allows wording to their own rules. Runs locally; no AWS access, no log upload.
python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdownRELATED
Related errors
- Access denied with an explicit deny — the SCP/Deny-statement case.
- Denied because no policy allows it — the missing-grant case.
- S3 error: Access Denied (deployment bucket) — the artifact-bucket special case with its own fix.