Error map
KMS AccessDenied kms:Decrypt KMS: not authorized to perform: kms:Decrypt (or the key policy does not allow access)
AWS · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (6). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (6)
An error occurred (UnauthorizedOperation): You are not authorized to perform this operation. Encoded authorization failure message: ...
The IAM identity is missing an EC2 (or related) permission. The encoded message tells you exactly which action and resource were…
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
The IAM user or role making the call has no permission for that action on that resource — the message names both.
InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda
The execution role’s trust policy doesn’t allow lambda.amazonaws.com — or the role was just created and IAM hasn’t propagated yet.
ECS: ResourceInitializationError: unable to pull secrets or registry auth
Fargate couldn’t fetch the task’s secrets (Secrets Manager/SSM) or registry credentials before starting containers.
is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...
The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust policy doesn’t trust t…
Two steps away (17)
PERMISSION_DENIED: The caller does not have permission (insufficient permissions)
You are authenticated, but your identity isn’t allowed to perform this action on this resource.
InsufficientInstanceCapacity: We currently do not have sufficient capacity in the Availability Zone you requested
AWS has no free capacity for that instance type in that Availability Zone right now.
VcpuLimitExceeded: You have requested more vCPU capacity than your current vCPU limit
Your account’s On-Demand (or Spot) vCPU quota for that instance family and region is used up.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
AWS: ThrottlingException / Rate exceeded
You exceeded the request rate for an AWS API; retry with exponential backoff.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Azure: AuthorizationFailed — The client does not have authorization to perform action
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.
API Gateway 403: User is not authorized to access this resource with an explicit deny
An API Gateway authorizer (Lambda/Cognito) or resource policy denied the request.
CloudFormation: Resource ... already exists (AlreadyExists / already exists in stack)
The template tries to create a resource with a fixed name that already exists — created manually, by another stack, or left over…
WordPress: Sorry, you are not allowed to access this page.
Your user role lacks the capability for that admin screen — or the database table prefix / user capabilities are out of sync afte…
Runtime.ImportModuleError: Unable to import module 'lambda_function': No module named 'x'
Lambda couldn’t load your handler file or one of its dependencies — the package is missing from the deployment zip/layer or the h…
Runtime.HandlerNotFound: index.handler is undefined or not exported
Lambda loaded the file but couldn’t find the function named in the handler setting.
Kubernetes: CreateContainerConfigError — secret / configmap not found
Kubernetes can’t build the container’s configuration — usually a referenced Secret, ConfigMap or key doesn’t exist in that namesp…
ECS task stopped: CannotPullContainerError: pull image manifest has been retried ... / ref pull has been retried
The ECS task couldn’t pull its image — no network route to the registry, missing ECR permissions, or a wrong image tag.
ECS: Essential container in task exited (task keeps stopping)
The main (essential) container stopped, so ECS stopped the whole task and the service keeps replacing it.
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
AADSTS70021: No matching federated identity record found for presented assertion (GitHub Actions / workload identity)
The OIDC token from GitHub Actions/Kubernetes/another IdP doesn’t match any federated credential on the app — issuer, subject or…
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException