Error map
UnauthorizedOperation / AccessDenied during Terraform apply Terraform: Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstances
Terraform · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...
The caller can’t assume the role — either its own policy doesn’t allow sts:AssumeRole, or the role’s trust policy doesn’t trust t…
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
The IAM user or role making the call has no permission for that action on that resource — the message names both.
Cloud Storage: 403 Forbidden — user@example.com does not have storage.objects.get access to the Google Cloud Storage object
The identity making the request has no read permission on that bucket or object.
Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server
The Cloud Run service requires authentication and the caller has no valid identity token or the `roles/run.invoker` role.
BigQuery: Access Denied: Project my-project: User does not have bigquery.jobs.create permission in project my-project
The principal can read data but is not allowed to run query jobs in the project used for billing.
Secret Manager: 7 PERMISSION_DENIED: Permission 'secretmanager.versions.access' denied for resource 'projects/123/secrets/db-pass/versions/latest'
The calling identity lacks the Secret Accessor role on that secret, or the secret/version does not exist.
Terraform: Error: No value for required variable — The root module input variable "region" is not set, and has no default value
A variable without a default wasn't supplied.
Terraform: Error: Invalid index — The given key does not identify an element in this collection value
You indexed a map/list/set with a key or position that doesn't exist.
Terraform: Error: building AzureRM Client: obtaining subscription ID / Please run 'az login' to setup account
The AzureRM provider can't find Azure credentials or a subscription.
Google Cloud: 403 PERMISSION_DENIED — Permission 'storage.objects.get' denied on resource (or it may not exist)
The caller's identity lacks the IAM permission named in the message on that resource.
Terraform: Error: Failed to get existing workspaces: S3 bucket "my-tf-state" does not exist / NoSuchBucket: The specified bucket does not exist
The S3 bucket configured as the state backend doesn't exist (or is in another region/account).
Two steps away (36)
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
UnrecognizedClientException: The security token included in the request is invalid
The access key or session token isn’t recognised — wrong/deleted key, a session token missing for temporary credentials, or a reg…
WordPress: Sorry, you are not allowed to access this page.
Your user role lacks the capability for that admin screen — or the database table prefix / user capabilities are out of sync afte…
InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda
The execution role’s trust policy doesn’t allow lambda.amazonaws.com — or the role was just created and IAM hasn’t propagated yet.
KMS: not authorized to perform: kms:Decrypt (or the key policy does not allow access)
The caller can’t use the KMS key that encrypts the data — the key policy or IAM policy doesn’t allow kms:Decrypt/GenerateDataKey.
Azure: AuthorizationFailed — The client does not have authorization to perform action
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.
PERMISSION_DENIED: The caller does not have permission (insufficient permissions)
You are authenticated, but your identity isn’t allowed to perform this action on this resource.
An error occurred (UnauthorizedOperation): You are not authorized to perform this operation. Encoded authorization failure message: ...
The IAM identity is missing an EC2 (or related) permission. The encoded message tells you exactly which action and resource were…
Pod stuck ContainerCreating: MountVolume.SetUp failed / Unable to attach or mount volumes: timed out waiting for the condition
The kubelet couldn’t mount one of the pod’s volumes, so the pod stays in ContainerCreating.
Multi-Attach error for volume: Volume is already exclusively attached to one node and can't be attached to another
A ReadWriteOnce volume (EBS, Azure Disk, PD) is still attached to another node, so the new pod on a different node can’t use it.
PersistentVolumeClaim stuck in Pending (no persistent volumes available / waiting for first consumer)
The PVC hasn’t been bound to a volume, so pods using it can’t be scheduled.
Cloud Run: 503 Service Unavailable — The request was aborted because there was no available instance
Cloud Run could not serve the request: no instance was ready, instances crashed, or the service hit its max-instances/concurrency…
Cloud Run: Memory limit of 512 MiB exceeded with 530 MiB used. Consider increasing the memory limit
The container used more memory than the Cloud Run service allows, so the instance was terminated.
Cloud Run: 504 Gateway Timeout — The request has been terminated because it has reached the maximum request timeout
The request ran longer than the service's request timeout (default 5 minutes, max 60), so Cloud Run closed it.
GCP: FAILED_PRECONDITION: Key creation is not allowed on this service account (constraints/iam.disableServiceAccountKeyCreation)
An organisation policy forbids creating downloadable JSON keys for service accounts.
gcloud: ERROR: (gcloud.auth.print-access-token) There was a problem refreshing your current auth tokens: Reauthentication failed. cannot prompt during non-interactive execution
Your cached Google credentials expired or require a fresh login (session control or password change), and gcloud can't prompt.
Google Cloud: 403 SERVICE_DISABLED — Cloud Resource Manager API has not been used in project 123456 before or it is disabled. Enable it by visiting
The Google API you called is not enabled for the project that the request is billed to.
gcloud/ADC: WARNING: Your active project does not match the quota project in your local Application Default Credentials file
Application Default Credentials bill API usage to a different project than the one you have set as active, which can cause surpri…
Terraform: Error: Attempted to load application default credentials since neither `credentials` nor `access_token` was set in the provider block. No credentials loaded
The Google provider has no credentials (ADC, service account key, impersonation).
Terraform: Error: Error creating Network: googleapi: Error 403: Compute Engine API has not been used in project 123 before or it is disabled
Terraform called a Google API that isn't enabled in the project.
Terraform: Error: Missing required argument — The argument "ami" is required, but no definition was found
A resource/module block lacks an argument the schema requires.
Terraform: Error: Invalid value for variable — "instance_type" must be a t3 type / The given value is not suitable for var.x declared at variables.tf:1,1-17: string required
A variable value failed its type or `validation` block.
Terraform: Error: Invalid function argument — Invalid value for "list" parameter: list of string required / Call to function "lookup" failed
A built-in function got a wrong type/value (empty list, missing key, wrong type).
Terraform: Error: Invalid count argument — The "count" value depends on resource attributes that cannot be determined until apply
`count` depends on something unknown at plan time, so Terraform can't decide how many instances to create.
Terraform: Error: Inconsistent conditional result types — The true and false result expressions must have consistent types
A `cond ? a : b` expression returns values of different types/shapes.
Terraform: Error: Unsupported attribute — This object has no argument, nested block, or exported attribute named "foo"
An expression references an attribute that the resource/data source/module output doesn't expose.
AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match
AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used differently from how it…
AADSTS50020: User account from identity provider does not exist in tenant and cannot access the application
The signed-in user belongs to another tenant (or is a personal Microsoft account) and isn’t a guest in the app’s tenant.
MissingSubscriptionRegistration: The subscription is not registered to use namespace 'Microsoft.X'
The resource provider (Microsoft.Web, Microsoft.ContainerService, …) isn’t registered for the subscription.
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
The docker CLI can’t talk to the Docker engine — it isn’t running, or your user can’t access the socket.
OAuth 2.0 Error: invalid_scope / insufficient_scope
The requested scope is unknown or not allowed for this client — or the token lacks the scope the API endpoint requires.
Error: listen EACCES: permission denied 0.0.0.0:80
Node isn’t allowed to bind that port — ports below 1024 need root on Linux/macOS, and some Windows ports are reserved.
Terraform: Error: Backend initialization required, please run "terraform init" — Reason: Initial configuration of the requested backend "s3"
Terraform needs `terraform init` to set up the backend (new directory, changed backend config, missing `.terraform`).
Terraform: Error: Backend configuration changed — A change in the backend configuration has been detected, which may require migrating existing state
The saved backend settings in `.terraform` differ from the current configuration.
Terraform: Error: Failed to load state: AccessDenied: Access Denied / Error refreshing state: AccessDenied status code: 403
Terraform can't read/write the S3 bucket (or DynamoDB table) that stores state — IAM permissions or wrong credentials/role.
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError