AWS denied a tagging action required by the deployment

WHAT IT MEANS

What this error means

Read the action in the error, not just the word AccessDenied. When it names a Tag* or Untag* action — iam:TagRole, lambda:TagResource, ec2:CreateTags — the permission gap is in the tag mutation:

An error occurred (AccessDenied) when calling the CreateRole operation:
User is not authorized to perform: iam:TagRole on resource: role my-app-role

Note which operation was called (CreateRole) versus which action was denied (iam:TagRole). When they differ, the tagging action is a permission paired with the create. A direct CreateTags or UntagResource call is already the primary operation. Two things commonly cause either shape:

• A deploy policy written without the tagging pair. Roles are routinely granted iam:CreateRole while iam:TagRole is forgotten, because tagging looks like a separate, later step. It is not — it is part of the create call.
• An Organizations tag policy or a CloudFormation hook rejecting the tag set. That verdict is enforced from a layer the member account cannot see, so nothing in the account's own policies looks wrong.

FIX

How to fix it

1. Record the exact tagging action and resource from the error before changing any policy, and confirm the identity that actually made the call:

   aws sts get-caller-identity

2. Grant the exact tagging action in its context. Pair application-autoscaling:TagResource with RegisterScalableTarget, iam:TagRole with iam:CreateRole, or EC2 CreateTags with create-time tags. For a direct retag or untag call, grant only that mutation. Scope it to the affected resource and use aws:RequestTag/${TagKey} and aws:TagKeys conditions where the service supports them.
3. If a tag policy or a hook rejected the tag set, identify the organizational layer that enforced it and resolve it with that layer's owner. Do not disable a tag policy or a CloudFormation hook to make a deployment pass — those exist to keep tagging consistent, and removing them to unblock a deploy trades a governance control for a green build.
4. Confirm before re-running with the IAM Policy Simulator, or look the denied call up in CloudTrail when the error carries a request ID.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor separates a denied tagging action from an ordinary missing-permission failure (medium confidence) and reports the denied action from redacted evidence — no raw ARNs. Runs locally; no AWS access, no log upload.

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED

Related errors

• A tag key or value failed validation — the same tag set rejected for its contents rather than for permissions.
• Access denied with an explicit deny — when a Deny statement blocks the action outright.
• Denied because no policy allows it — the implicit-deny sibling for non-tagging actions.