Terraform: Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstances
The IAM identity used by Terraform lacks a permission needed for that resource.
Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operationUser: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstancesError: error creating: AccessDenied: User is not authorized to performis not authorized to perform: iam:PassRole on resourceEncoded authorization failure message Meaning
The message names the action (ec2:RunInstances) and principal. Add it to the role policy (or fix SCP/permission boundary/resource conditions). Decode encoded authorization messages with aws sts decode-authorization-message. Least-privilege Terraform roles often need many actions incl. iam:PassRole and tag permissions.
Common causes
- Missing IAM action
iam:PassRolemissing- Permission boundary/SCP denies
- Resource-level conditions (tags, region)
- Wrong role assumed
⚡ Quick fix
- Add the action to the role policy
- Decode:
aws sts decode-authorization-message --encoded-message ... - Check SCPs/boundaries and the assumed role
Detailed fix by platform
AWS
aws iam simulate-principal-policy --policy-source-arn ROLE_ARN --action-names ec2:RunInstances
How to diagnose
- Action — In message?
- Principal — Which role?
- Boundary — SCP?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
- 403: does not have storage.objects.get access Cloud Storage: 403 Forbidden — user@example.com does not have storage.objects.get access to the Google Cloud Storage object
- BigQuery: Access Denied: Project: User does not have bigquery.jobs.create permission BigQuery: Access Denied: Project my-project: User does not have bigquery.jobs.create permission in project my-project
- BucketNotEmpty: bucket you tried to delete is not empty Terraform: Error: deleting S3 Bucket (my-bucket): BucketNotEmpty: The bucket you tried to delete is not empty
Most viewed in Terraform
- Error acquiring the state lock Terraform: Error: Error acquiring the state lock — ConditionalCheckFailedException / state blob is already locked
- Inconsistent dependency lock file Terraform: Error: Inconsistent dependency lock file — provider x: required by this configuration but no version is selected
- Reference to undeclared resource Terraform: Error: Reference to undeclared resource / Reference to undeclared input variable
Other ways to find it
Where this error sits
Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 5 Nov 2026