Error map
IAM AccessDeniedException AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
AWS · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
SES MessageRejected: Email address is not verified. The following identities failed the check in region
SES refused to send because the From address/domain isn’t verified — or the account is still in the SES sandbox, where recipients…
AWS Cognito: NotAuthorizedException: Incorrect username or password
Cognito rejected the sign-in — wrong credentials, a disabled user, an auth flow not enabled on the app client, or an expired refr…
PERMISSION_DENIED: The caller does not have permission (insufficient permissions)
You are authenticated, but your identity isn’t allowed to perform this action on this resource.
An error occurred (UnauthorizedOperation): You are not authorized to perform this operation. Encoded authorization failure message: ...
The IAM identity is missing an EC2 (or related) permission. The encoded message tells you exactly which action and resource were…
CloudFront: 403 ERROR — The request could not be satisfied
CloudFront refused or couldn’t serve the request — wrong alternate domain/certificate, blocked by origin access settings, a WAF/g…
Azure: AuthorizationFailed — The client does not have authorization to perform action
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.
API Gateway 403: User is not authorized to access this resource with an explicit deny
An API Gateway authorizer (Lambda/Cognito) or resource policy denied the request.
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda
The execution role’s trust policy doesn’t allow lambda.amazonaws.com — or the role was just created and IAM hasn’t propagated yet.
ECS: ResourceInitializationError: unable to pull secrets or registry auth
Fargate couldn’t fetch the task’s secrets (Secrets Manager/SSM) or registry credentials before starting containers.
is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...
The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust policy doesn’t trust t…
SQS: The specified queue does not exist (AWS.SimpleQueueService.NonExistentQueue / QueueDoesNotExist)
The queue URL/name doesn’t exist in that region/account, or it was deleted (recently deleted names are blocked for 60 seconds).
Two steps away (32)
PHP mail() returns false / emails not delivered
PHP’s mail() function failed or emails never arrive (spam or rejected).
API Gateway {"message": "Internal server error"} 502 — Malformed Lambda proxy response
The Lambda behind an API Gateway proxy integration returned something that isn’t the required {statusCode, headers, body} shape,…
API Gateway: {"message": "Endpoint request timed out"} (504 after 29 seconds)
The backend (usually Lambda) didn’t respond within API Gateway’s integration timeout (29 seconds by default for REST APIs).
Git: Permission denied (publickey). fatal: Could not read from remote repository.
SSH authentication to GitHub/GitLab/Bitbucket failed — no key, wrong key, or the key isn’t added to your account.
Azure AD (Entra ID): AADSTS700016 Application not found in the directory
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
npm ERR! code EACCES — permission denied
npm can’t write to a directory — usually global installs into a root-owned folder.
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
The docker CLI can’t talk to the Docker engine — it isn’t running, or your user can’t access the socket.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
InsufficientInstanceCapacity: We currently do not have sufficient capacity in the Availability Zone you requested
AWS has no free capacity for that instance type in that Availability Zone right now.
VcpuLimitExceeded: You have requested more vCPU capacity than your current vCPU limit
Your account’s On-Demand (or Spot) vCPU quota for that instance family and region is used up.
InvalidKeyPair.NotFound: The key pair 'x' does not exist
The key pair name you passed doesn’t exist in that region (key pairs are regional).
Cloudflare Error 520: Web Server Returned an Unknown Error
Cloudflare connected to your origin, but the origin returned an empty, unknown or invalid response.
ACM certificate stuck in Pending validation
ACM is waiting to see the DNS (or email) validation record — it wasn’t created, was created in the wrong DNS zone, or has a typo.
Azure Front Door: Our services aren't available right now (503/502 from Front Door)
Front Door couldn’t get a valid response from your origin — origin down, health probes failing, TLS/host header mismatch, or a ti…
Azure Storage: AuthorizationPermissionMismatch (403) — This request is not authorized to perform this operation using this permission
You’re accessing blob/queue data with Microsoft Entra ID, but the identity has only management roles (Owner/Contributor) — not a…
Azure: SkuNotAvailable / QuotaExceeded when creating a VM or resource
The VM size isn’t offered in that region/zone for your subscription, or you’ve hit the vCPU quota.
Error from server (Forbidden): pods is forbidden: User "x" cannot list resource "pods" in API group "" in the namespace
You’re authenticated to the cluster, but RBAC doesn’t give your user or service account that verb on that resource.
{"message":"Missing Authentication Token"} / No authorization token was found
The request reached a protected endpoint without credentials — or, on AWS API Gateway, it hit a path/method that doesn’t exist.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
AWS: ThrottlingException / Rate exceeded
You exceeded the request rate for an AWS API; retry with exponential backoff.
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
WordPress: Sorry, you are not allowed to access this page.
Your user role lacks the capability for that admin screen — or the database table prefix / user capabilities are out of sync afte…
Runtime.ImportModuleError: Unable to import module 'lambda_function': No module named 'x'
Lambda couldn’t load your handler file or one of its dependencies — the package is missing from the deployment zip/layer or the h…
Runtime.HandlerNotFound: index.handler is undefined or not exported
Lambda loaded the file but couldn’t find the function named in the handler setting.
Kubernetes: CreateContainerConfigError — secret / configmap not found
Kubernetes can’t build the container’s configuration — usually a referenced Secret, ConfigMap or key doesn’t exist in that namesp…
KMS: not authorized to perform: kms:Decrypt (or the key policy does not allow access)
The caller can’t use the KMS key that encrypts the data — the key policy or IAM policy doesn’t allow kms:Decrypt/GenerateDataKey.
ECS task stopped: CannotPullContainerError: pull image manifest has been retried ... / ref pull has been retried
The ECS task couldn’t pull its image — no network route to the registry, missing ECR permissions, or a wrong image tag.
AADSTS70021: No matching federated identity record found for presented assertion (GitHub Actions / workload identity)
The OIDC token from GitHub Actions/Kubernetes/another IdP doesn’t match any federated credential on the app — issuer, subject or…
S3 PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint
The request went to the wrong S3 region/endpoint for that bucket.
InvalidAMIID.NotFound: The image id '[ami-xxxx]' does not exist
The AMI ID isn’t available in this region/account — AMI IDs are regional and private AMIs must be shared.
DynamoDB ResourceNotFoundException: Requested resource not found (table)
The table (or index) doesn’t exist in the region/account the client is using.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException