UnauthorizedOperation / AccessDenied during Terraform apply Terraform Origin: Platform & cloud OSI layer 7 · Application Last updated 5 Nov 2026

Terraform: Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstances

The IAM identity used by Terraform lacks a permission needed for that resource.

Exact message you may see Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operationUser: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstancesError: error creating: AccessDenied: User is not authorized to performis not authorized to perform: iam:PassRole on resourceEncoded authorization failure message
Seen on: Terraform AWS

Meaning

The message names the action (ec2:RunInstances) and principal. Add it to the role policy (or fix SCP/permission boundary/resource conditions). Decode encoded authorization messages with aws sts decode-authorization-message. Least-privilege Terraform roles often need many actions incl. iam:PassRole and tag permissions.

Common causes

  • Missing IAM action
  • iam:PassRole missing
  • Permission boundary/SCP denies
  • Resource-level conditions (tags, region)
  • Wrong role assumed

⚡ Quick fix

  1. Add the action to the role policy
  2. Decode: aws sts decode-authorization-message --encoded-message ...
  3. Check SCPs/boundaries and the assumed role

Detailed fix by platform

AWS

  1. aws iam simulate-principal-policy --policy-source-arn ROLE_ARN --action-names ec2:RunInstances

How to diagnose

  1. Action — In message?
  2. Principal — Which role?
  3. Boundary — SCP?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

403: does not have storage.objects.get access — Cloud Storage: 403 Forbidden — user@example.com does not have storage.objects.get access to the Google Cloud Storage object (Google Cloud / Firebase)403: does not have st…BigQuery: Access Denied: Project: User does not have bigquery.jobs.create permission — BigQuery: Access Denied: Project my-project: User does not have bigquery.jobs.create permission in project my-project (Google Cloud / Firebase)BigQuery: Access Deni…BucketNotEmpty: bucket you tried to delete is not empty — Terraform: Error: deleting S3 Bucket (my-bucket): BucketNotEmpty: The bucket you tried to delete is not empty (Terraform)BucketNotEmpty: bucke…Cloud Run 403: Your client does not have permission to get URL — Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server (Google Cloud / Firebase)Cloud Run 403: Your c…DependencyViolation: resource has dependent objects (destroy) — Terraform: Error: deleting EC2 VPC (vpc-0abc): DependencyViolation: The vpc 'vpc-0abc' has dependencies and cannot be deleted (Terraform)DependencyViolation: …Error 403: API has not been used in project (Terraform) — Terraform: Error: Error creating Network: googleapi: Error 403: Compute Engine API has not been used in project 123 before or it is disabled (Terraform)Error 403: API has no…Error building ARM Config: obtain subscription from Azure CLI — Terraform: Error: building AzureRM Client: obtaining subscription ID / Please run 'az login' to setup account (Terraform)Error building ARM Co…Error loading state: AccessDenied (S3 backend) — Terraform: Error: Failed to load state: AccessDenied: Access Denied / Error refreshing state: AccessDenied status code: 403 (Terraform)Error loading state: …Unauthori…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.