Error map
not authorized to access this resource API Gateway 403: User is not authorized to access this resource with an explicit deny
AWS · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (10). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (10)
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
API Gateway: {"message": "Endpoint request timed out"} (504 after 29 seconds)
The backend (usually Lambda) didn’t respond within API Gateway’s integration timeout (29 seconds by default for REST APIs).
API Gateway {"message": "Internal server error"} 502 — Malformed Lambda proxy response
The Lambda behind an API Gateway proxy integration returned something that isn’t the required {statusCode, headers, body} shape,…
SES MessageRejected: Email address is not verified. The following identities failed the check in region
SES refused to send because the From address/domain isn’t verified — or the account is still in the SES sandbox, where recipients…
PERMISSION_DENIED: The caller does not have permission (insufficient permissions)
You are authenticated, but your identity isn’t allowed to perform this action on this resource.
CloudFront: 403 ERROR — The request could not be satisfied
CloudFront refused or couldn’t serve the request — wrong alternate domain/certificate, blocked by origin access settings, a WAF/g…
Azure: AuthorizationFailed — The client does not have authorization to perform action
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
The IAM user or role making the call has no permission for that action on that resource — the message names both.
{"message":"Missing Authentication Token"} / No authorization token was found
The request reached a protected endpoint without credentials — or, on AWS API Gateway, it hit a path/method that doesn’t exist.
Two steps away (29)
Git: Permission denied (publickey). fatal: Could not read from remote repository.
SSH authentication to GitHub/GitLab/Bitbucket failed — no key, wrong key, or the key isn’t added to your account.
Linux: Permission denied
Your user (or the service user) lacks read/write/execute permission on a file, directory or one of its parents.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
MySQL ERROR 2006 (HY000): MySQL server has gone away
The connection to MySQL was closed — usually by a timeout or a packet larger than `max_allowed_packet`.
HTTP 408 Request Timeout
The server closed the connection because the client took too long to send the complete request.
HTTP 504 Gateway Timeout
A proxy or gateway waited too long for the upstream server to respond and gave up.
HTTP 500 Internal Server Error
The server hit an unexpected condition — usually an unhandled exception or misconfiguration in the application.
HTTP 502 Bad Gateway
A proxy or gateway (Nginx, load balancer, CDN) got an invalid response — or no response — from the upstream server behind it.
AWS Lambda: Task timed out after X seconds
The function ran longer than its configured timeout (default 3 seconds) and Lambda stopped it.
PHP mail() returns false / emails not delivered
PHP’s mail() function failed or emails never arrive (spam or rejected).
ACM certificate stuck in Pending validation
ACM is waiting to see the DNS (or email) validation record — it wasn’t created, was created in the wrong DNS zone, or has a typo.
Elastic Beanstalk: Environment health has transitioned from Ok to Severe
Most instances in the Elastic Beanstalk environment are failing health checks or returning errors.
npm ERR! code EACCES — permission denied
npm can’t write to a directory — usually global installs into a root-owned folder.
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
The docker CLI can’t talk to the Docker engine — it isn’t running, or your user can’t access the socket.
OAuth 2.0 Error: invalid_scope / insufficient_scope
The requested scope is unknown or not allowed for this client — or the token lacks the scope the API endpoint requires.
Cloudflare Error 520: Web Server Returned an Unknown Error
Cloudflare connected to your origin, but the origin returned an empty, unknown or invalid response.
Azure Front Door: Our services aren't available right now (503/502 from Front Door)
Front Door couldn’t get a valid response from your origin — origin down, health probes failing, TLS/host header mismatch, or a ti…
Azure Storage: AuthorizationPermissionMismatch (403) — This request is not authorized to perform this operation using this permission
You’re accessing blob/queue data with Microsoft Entra ID, but the identity has only management roles (Owner/Contributor) — not a…
Azure: SkuNotAvailable / QuotaExceeded when creating a VM or resource
The VM size isn’t offered in that region/zone for your subscription, or you’ve hit the vCPU quota.
Error from server (Forbidden): pods is forbidden: User "x" cannot list resource "pods" in API group "" in the namespace
You’re authenticated to the cluster, but RBAC doesn’t give your user or service account that verb on that resource.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
AWS: ThrottlingException / Rate exceeded
You exceeded the request rate for an AWS API; retry with exponential backoff.
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
An error occurred (UnauthorizedOperation): You are not authorized to perform this operation. Encoded authorization failure message: ...
The IAM identity is missing an EC2 (or related) permission. The encoded message tells you exactly which action and resource were…
is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...
The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust policy doesn’t trust t…
InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda
The execution role’s trust policy doesn’t allow lambda.amazonaws.com — or the role was just created and IAM hasn’t propagated yet.
Azure AD (Entra ID): AADSTS700016 Application not found in the directory
The client ID in your sign-in request doesn’t exist in the tenant you’re authenticating against.
JWT Expired / Invalid Token
The JSON Web Token sent with the request is expired, malformed or signed with a different key, so the API rejects it (usually wit…
OAuth 2.0 Error: invalid_grant
The authorization code, refresh token or credentials sent to the token endpoint are invalid, expired, already used or were issued…
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException