Error map
sts:AssumeRole denied is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::...:role/...
AWS · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (11). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (11)
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
AWS: Unable to locate credentials / Could not load credentials from any providers
The AWS CLI/SDK found no credentials in any place it looks — env vars, profile files, SSO cache or an instance/task role.
InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda
The execution role’s trust policy doesn’t allow lambda.amazonaws.com — or the role was just created and IAM hasn’t propagated yet.
AADSTS70021: No matching federated identity record found for presented assertion (GitHub Actions / workload identity)
The OIDC token from GitHub Actions/Kubernetes/another IdP doesn’t match any federated credential on the app — issuer, subject or…
GitHub Actions: Error: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable
A step tried to get an OIDC token (for AWS, Azure, GCP, Vault) but the job was not granted `id-token: write` permission.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
KMS: not authorized to perform: kms:Decrypt (or the key policy does not allow access)
The caller can’t use the KMS key that encrypts the data — the key policy or IAM policy doesn’t allow kms:Decrypt/GenerateDataKey.
WordPress: Sorry, you are not allowed to access this page.
Your user role lacks the capability for that admin screen — or the database table prefix / user capabilities are out of sync afte…
AccessDeniedException: User: arn:aws:iam::... is not authorized to perform: service:Action on resource: ...
The IAM user or role making the call has no permission for that action on that resource — the message names both.
ECS: ResourceInitializationError: unable to pull secrets or registry auth
Fargate couldn’t fetch the task’s secrets (Secrets Manager/SSM) or registry credentials before starting containers.
GitHub Actions: Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers
`aws-actions/configure-aws-credentials` found no usable credentials — no keys, no role to assume, or the OIDC token was not reque…
Two steps away (31)
AWS: ThrottlingException / Rate exceeded
You exceeded the request rate for an AWS API; retry with exponential backoff.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Azure: AuthorizationFailed — The client does not have authorization to perform action
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.
UnrecognizedClientException: The security token included in the request is invalid
The access key or session token isn’t recognised — wrong/deleted key, a session token missing for temporary credentials, or a reg…
You must specify a region. You can also configure your region by running "aws configure" (NoRegionError)
No region is configured for the CLI/SDK call.
Google Cloud: Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started
The Google client library found no Application Default Credentials (ADC) on this machine or environment.
Runtime.ImportModuleError: Unable to import module 'lambda_function': No module named 'x'
Lambda couldn’t load your handler file or one of its dependencies — the package is missing from the deployment zip/layer or the h…
Runtime.HandlerNotFound: index.handler is undefined or not exported
Lambda loaded the file but couldn’t find the function named in the handler setting.
Lambda: Runtime exited with error: signal: killed (Runtime.ExitError)
The function process was killed — almost always because it ran out of its configured memory.
! [remote rejected] main -> main (shallow update not allowed)
You pushed from a shallow clone to a remote that doesn’t accept shallow history.
remote: Permission to owner/repo.git denied to github-actions[bot]. fatal: unable to access … The requested URL returned error: 403
A GitHub Actions workflow tried to push but the GITHUB_TOKEN doesn’t have write permission.
npm ERR! `npm ci` can only install packages when your package.json and package-lock.json are in sync
package-lock.json doesn’t match package.json, so npm ci refuses to install.
GitHub Actions: Error: Resource not accessible by integration (403)
The workflow’s GITHUB_TOKEN doesn’t have the permission needed for that API call (comment, push, create release, write packages).
GitHub Actions: secret is empty on pull_request from a fork or Dependabot (Secrets are not passed to workflows triggered by a fork)
Secrets are intentionally withheld from workflows that run for pull requests from forks and, by default, for Dependabot PRs — so…
GitHub Actions: Cache not found for input keys: npm-Linux-abc123 / Failed to save: Unable to reserve cache with key, another job may be creating this cache
`actions/cache` either found nothing for your key (restore miss) or could not save because another run is already saving the same…
kubectl: The connection to the server localhost:8080 was refused — did you specify the right host or port?
kubectl has no usable kubeconfig, so it falls back to localhost:8080 — or the cluster API server is unreachable.
AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match
AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used differently from how it…
Warning: session_start(): Session cannot be started after headers have already been sent
session_start() ran after output was sent, so PHP can’t set the session cookie.
An error occurred (UnauthorizedOperation): You are not authorized to perform this operation. Encoded authorization failure message: ...
The IAM identity is missing an EC2 (or related) permission. The encoded message tells you exactly which action and resource were…
WordPress: Error Establishing a Database Connection
WordPress can’t connect to its MySQL/MariaDB database with the credentials in wp-config.php, or the database server is down.
WordPress: There Has Been a Critical Error on This Website
A PHP fatal error (usually from a plugin or theme) stopped WordPress; the real error is in the debug log or recovery-mode email.
java.nio.file.AccessDeniedException: /path
The OS denied a file operation to the Java process.
PERMISSION_DENIED: The caller does not have permission (insufficient permissions)
You are authenticated, but your identity isn’t allowed to perform this action on this resource.
API Gateway 403: User is not authorized to access this resource with an explicit deny
An API Gateway authorizer (Lambda/Cognito) or resource policy denied the request.
CloudFormation: Resource ... already exists (AlreadyExists / already exists in stack)
The template tries to create a resource with a fixed name that already exists — created manually, by another stack, or left over…
Kubernetes: CreateContainerConfigError — secret / configmap not found
Kubernetes can’t build the container’s configuration — usually a referenced Secret, ConfigMap or key doesn’t exist in that namesp…
ECS task stopped: CannotPullContainerError: pull image manifest has been retried ... / ref pull has been retried
The ECS task couldn’t pull its image — no network route to the registry, missing ECR permissions, or a wrong image tag.
ECS: Essential container in task exited (task keeps stopping)
The main (essential) container stopped, so ECS stopped the whole task and the service keeps replacing it.
GitHub Actions: Invalid workflow file: .github/workflows/ci.yml#L12 — You have an error in your yaml syntax on line 12
GitHub could not parse your workflow YAML, so no run was created — usually indentation, a tab, or an unquoted special character.
GitHub Actions: Unrecognized named-value: 'secrets'. Located at position 1 within expression: secrets.API_KEY
You used an expression context (`secrets`, `env`, `matrix`, `steps`…) in a place of the workflow where that context is not availa…
GitHub Actions: workflow does not run on push / pull_request / workflow_dispatch button missing
A workflow file exists but no run appears — the trigger filters do not match, the file is not on the right branch, or the workflo…
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError