Error map

sts:AssumeRole denied is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...

AWS · layer 6, Platform & cloud

Centre: this error. First ring: errors it is linked with (9). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.

2 · Network 4 · Application & API 6 · Platform & cloud 7 · Build & delivery

Directly related (9)

ExpiredTokenAWS

AWS: ExpiredToken — The security token included in the request is expired

Temporary AWS credentials (STS/SSO/assumed role) have expired.

AccessDeniedAWS

AWS S3: AccessDenied (403) when calling GetObject / PutObject

An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.

Not allowedWordPress

WordPress: Sorry, you are not allowed to access this page.

Your user role lacks the capability for that admin screen — or the database table prefix / user capabilities are out of sync afte…

IAM AccessDeniedExceptionAWS

AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...

The IAM user or role making the call has no permission for that action on that resource — the message names both.

role cannot be assumed by LambdaAWS

InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda

The execution role’s trust policy doesn’t allow lambda.amazonaws.com — or the role was just created and IAM hasn’t propagated yet.

ResourceInitializationErrorAWS

ECS: ResourceInitializationError: unable to pull secrets or registry auth

Fargate couldn’t fetch the task’s secrets (Secrets Manager/SSM) or registry credentials before starting containers.

NoCredentialsErrorAWS

AWS: Unable to locate credentials / Could not load credentials from any providers

The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.

KMS AccessDenied kms:DecryptAWS

KMS: not authorized to perform: kms:Decrypt (or the key policy does not allow access)

The caller can’t use the KMS key that encrypts the data — the key policy or IAM policy doesn’t allow kms:Decrypt/GenerateDataKey.

AADSTS70021Azure

AADSTS70021: No matching federated identity record found for presented assertion (GitHub Actions / workload identity)

The OIDC token from GitHub Actions/Kubernetes/another IdP doesn’t match any federated credential on the app — issuer, subject or…

Two steps away (24)

kubectl connection refusedKubernetes

kubectl: The connection to the server localhost:8080 was refused — did you specify the right host or port?

kubectl has no usable kubeconfig, so it falls back to localhost:8080 — or the cluster API server is unreachable.

SignatureDoesNotMatchAWS

AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match

AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used differently from how it…

session_start()PHP

Warning: session_start(): Session cannot be started after headers have already been sent

session_start() ran after output was sent, so PHP can’t set the session cookie.

ThrottlingExceptionAWS

AWS: ThrottlingException / Rate exceeded

You exceeded the request rate for an AWS API; retry with exponential backoff.

403HTTP

HTTP 403 Forbidden

The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…

AuthorizationFailedAzure

Azure: AuthorizationFailed — The client does not have authorization to perform action

The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.

DB connectionWordPress

WordPress: Error Establishing a Database Connection

WordPress can’t connect to its MySQL/MariaDB database with the credentials in wp-config.php, or the database server is down.

Critical errorWordPress

WordPress: There Has Been a Critical Error on This Website

A PHP fatal error (usually from a plugin or theme) stopped WordPress; the real error is in the debug log or recovery-mode email.

AccessDeniedExceptionJava

java.nio.file.AccessDeniedException: /path

The OS denied a file operation to the Java process.

PERMISSION_DENIEDAuthentication

PERMISSION_DENIED: The caller does not have permission (insufficient permissions)

You are authenticated, but your identity isn’t allowed to perform this action on this resource.

UnauthorizedOperationAWS

An error occurred (UnauthorizedOperation): You are not authorized to perform this operation. Encoded authorization failure message: ...

The IAM identity is missing an EC2 (or related) permission. The encoded message tells you exactly which action and resource were…

not authorized to access this resourceAWS

Google Cloud: Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started

The Google client library found no Application Default Credentials (ADC) on this machine or environment.

shallow update not allowedGit

! [remote rejected] main -> main (shallow update not allowed)

You pushed from a shallow clone to a remote that doesn’t accept shallow history.

github-actions[bot] 403Git

remote: Permission to owner/repo.git denied to github-actions[bot]. fatal: unable to access … The requested URL returned error: 403

A GitHub Actions workflow tried to push but the GITHUB_TOKEN doesn’t have write permission.

npm ci out of syncnpm

npm ERR! `npm ci` can only install packages when your package.json and package-lock.json are in sync

package-lock.json doesn’t match package.json, so npm ci refuses to install.