Error map
UnauthorizedOperation An error occurred (UnauthorizedOperation): You are not authorized to perform this operation. Encoded authorization failure message: ...
AWS · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (9). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (9)
PERMISSION_DENIED: The caller does not have permission (insufficient permissions)
You are authenticated, but your identity isn’t allowed to perform this action on this resource.
EC2 status check failed: Instance reachability check failed (1/2 checks passed)
AWS can reach the host, but the operating system inside the instance isn’t responding — kernel panic, full disk, broken network c…
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
The IAM user or role making the call has no permission for that action on that resource — the message names both.
InsufficientInstanceCapacity: We currently do not have sufficient capacity in the Availability Zone you requested
AWS has no free capacity for that instance type in that Availability Zone right now.
VcpuLimitExceeded: You have requested more vCPU capacity than your current vCPU limit
Your account’s On-Demand (or Spot) vCPU quota for that instance family and region is used up.
InvalidAMIID.NotFound: The image id '[ami-xxxx]' does not exist
The AMI ID isn’t available in this region/account — AMI IDs are regional and private AMIs must be shared.
KMS: not authorized to perform: kms:Decrypt (or the key policy does not allow access)
The caller can’t use the KMS key that encrypts the data — the key policy or IAM policy doesn’t allow kms:Decrypt/GenerateDataKey.
InvalidKeyPair.NotFound: The key pair 'x' does not exist
The key pair name you passed doesn’t exist in that region (key pairs are regional).
Two steps away (23)
npm ERR! code EACCES — permission denied
npm can’t write to a directory — usually global installs into a root-owned folder.
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
The docker CLI can’t talk to the Docker engine — it isn’t running, or your user can’t access the socket.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
mount: wrong fs type, bad option, bad superblock on /dev/sdb1, missing codepage or helper program
mount couldn’t mount the device — the filesystem type isn’t supported/installed, the partition is wrong, or the filesystem is dam…
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
The kernel booted but couldn’t mount the root filesystem — usually a missing or broken initramfs after a kernel update.
error: unknown filesystem. Entering rescue mode... grub rescue>
GRUB can’t find or read the partition holding its files — common after resizing/deleting partitions or installing Windows alongsi…
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
AWS: ThrottlingException / Rate exceeded
You exceeded the request rate for an AWS API; retry with exponential backoff.
Azure: AuthorizationFailed — The client does not have authorization to perform action
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.
is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...
The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust policy doesn’t trust t…
InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda
The execution role’s trust policy doesn’t allow lambda.amazonaws.com — or the role was just created and IAM hasn’t propagated yet.
API Gateway 403: User is not authorized to access this resource with an explicit deny
An API Gateway authorizer (Lambda/Cognito) or resource policy denied the request.
HTTP 503 Service Unavailable
The server is temporarily unable to handle the request — overloaded, in maintenance, or has no healthy backends.
MySQL ERROR 1040 (08004): Too many connections
MySQL reached `max_connections` and refuses new clients.
Azure: SkuNotAvailable / QuotaExceeded when creating a VM or resource
The VM size isn’t offered in that region/zone for your subscription, or you’ve hit the vCPU quota.
HTTP 402 Payment Required
The service wants payment before it will process the request — an unpaid invoice, exhausted credits or a failed card.
Error creating: pods is forbidden: exceeded quota: compute-resources, requested: limits.memory=1Gi, used: ..., limited: ...
The namespace’s ResourceQuota doesn’t have room for the new pod’s requests/limits (or object count).
pods is forbidden: failed quota: must specify limits.cpu,limits.memory,requests.cpu,requests.memory
A ResourceQuota on the namespace covers CPU/memory, so every pod must declare those requests/limits — and this one doesn’t.
S3 PermanentRedirect: The bucket you are attempting to access must be addressed using the specified endpoint
The request went to the wrong S3 region/endpoint for that bucket.
DynamoDB ResourceNotFoundException: Requested resource not found (table)
The table (or index) doesn’t exist in the region/account the client is using.
SQS: The specified queue does not exist (AWS.SimpleQueueService.NonExistentQueue / QueueDoesNotExist)
The queue URL/name doesn’t exist in that region/account, or it was deleted (recently deleted names are blocked for 60 seconds).
ECS: ResourceInitializationError: unable to pull secrets or registry auth
Fargate couldn’t fetch the task’s secrets (Secrets Manager/SSM) or registry credentials before starting containers.
LocationNotAvailableForResourceType / InvalidResourceLocation
The resource type isn’t offered in that region, or the resource already exists in a different region than the template says.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException