Error map
ResourceInitializationError ECS: ResourceInitializationError: unable to pull secrets or registry auth
AWS · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (10). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (10)
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
Kubernetes: CreateContainerConfigError — secret / configmap not found
Kubernetes can’t build the container’s configuration — usually a referenced Secret, ConfigMap or key doesn’t exist in that namesp…
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
The IAM user or role making the call has no permission for that action on that resource — the message names both.
InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda
The execution role’s trust policy doesn’t allow lambda.amazonaws.com — or the role was just created and IAM hasn’t propagated yet.
is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...
The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust policy doesn’t trust t…
KMS: not authorized to perform: kms:Decrypt (or the key policy does not allow access)
The caller can’t use the KMS key that encrypts the data — the key policy or IAM policy doesn’t allow kms:Decrypt/GenerateDataKey.
ECS task stopped: CannotPullContainerError: pull image manifest has been retried ... / ref pull has been retried
The ECS task couldn’t pull its image — no network route to the registry, missing ECR permissions, or a wrong image tag.
AADSTS7000222: The provided client secret keys for app are expired
The app registration’s client secret has expired, so service-to-service authentication fails.
Key Vault: (SecretNotFound) A secret with (name/id) x was not found in this key vault
The secret name (or version) doesn’t exist in that vault — typo, wrong vault, or the secret is deleted (soft-deleted).
ECS: Essential container in task exited (task keeps stopping)
The main (essential) container stopped, so ECS stopped the whole task and the service keeps replacing it.
Two steps away (26)
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
AWS: ThrottlingException / Rate exceeded
You exceeded the request rate for an AWS API; retry with exponential backoff.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Kubernetes: CrashLoopBackOff
The container starts, crashes (or exits), and Kubernetes keeps restarting it with increasing back-off delays.
KeyError: 'x'
You accessed a dictionary key that doesn’t exist.
Kubernetes: Pod stuck in Pending — FailedScheduling: 0/3 nodes are available
The scheduler can’t find a node that satisfies the pod’s resource requests, selectors, taints or volume constraints.
Azure: AuthorizationFailed — The client does not have authorization to perform action
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.
PERMISSION_DENIED: The caller does not have permission (insufficient permissions)
You are authenticated, but your identity isn’t allowed to perform this action on this resource.
An error occurred (UnauthorizedOperation): You are not authorized to perform this operation. Encoded authorization failure message: ...
The IAM identity is missing an EC2 (or related) permission. The encoded message tells you exactly which action and resource were…
WordPress: Sorry, you are not allowed to access this page.
Your user role lacks the capability for that admin screen — or the database table prefix / user capabilities are out of sync afte…
Runtime.ImportModuleError: Unable to import module 'lambda_function': No module named 'x'
Lambda couldn’t load your handler file or one of its dependencies — the package is missing from the deployment zip/layer or the h…
Runtime.HandlerNotFound: index.handler is undefined or not exported
Lambda loaded the file but couldn’t find the function named in the handler setting.
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
AADSTS70021: No matching federated identity record found for presented assertion (GitHub Actions / workload identity)
The OIDC token from GitHub Actions/Kubernetes/another IdP doesn’t match any federated credential on the app — issuer, subject or…
Kubernetes: ImagePullBackOff / ErrImagePull
The node can’t pull the container image — wrong name/tag, missing registry credentials, or registry unreachable.
npm ERR! code EROFS — EROFS: read-only file system
npm tried to write to a read-only location (read-only container filesystem, mounted volume, or system path).
denied: Your authorization token has expired. Reauthenticate and try again. (Amazon ECR)
Docker’s login to Amazon ECR has expired — ECR tokens last 12 hours, so pushes and pulls fail until you log in again.
OAuth 2.0 Error: invalid_client
The OAuth server couldn’t authenticate your application — wrong client ID/secret, wrong auth method, or the client doesn’t exist…
AADSTS50020: User account from identity provider does not exist in tenant and cannot access the application
The signed-in user belongs to another tenant (or is a personal Microsoft account) and isn’t a guest in the app’s tenant.
AADSTS50034: The user account does not exist in the directory
There’s no user with that sign-in name in the tenant.
AADSTS500113: No reply address is registered for the application
The app registration has no redirect URI for the platform being used, so Entra ID has nowhere to send the response.
ResourceNotFound: The Resource 'Microsoft.X/...' under resource group 'y' was not found
The specific resource doesn’t exist in that resource group/subscription — wrong name, group or subscription, or it was deleted.
Key Vault: (Forbidden) The user, group or application does not have secrets get permission on key vault
The caller authenticated but has no permission on the vault — missing access policy or RBAC role, or the vault’s firewall blocks…
ALB target unhealthy: Health checks failed with these codes: [404] / Request timed out
The load balancer’s health checks to your targets fail, so it stops sending traffic (and returns 502/503 if no targets are health…
Docker container exits immediately (Exited (0) / Exited (1) right after start)
The container started and its main process finished at once, so the container stopped — Docker containers only live as long as PI…
Error response from daemon: Container X is not running
You tried to exec into or interact with a container that has stopped.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException