# Terraform: Error: creating EC2 Instance: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:iam::123:user/ci is not authorized to perform: ec2:RunInstances

**Code:** `UnauthorizedOperation / AccessDenied during Terraform apply` · **Category:** Terraform · **Seen on:** Terraform, AWS

The IAM identity used by Terraform lacks a permission needed for that resource.

## Meaning

The message names the action (`ec2:RunInstances`) and principal. Add it to the role policy (or fix SCP/permission boundary/resource conditions). Decode encoded authorization messages with `aws sts decode-authorization-message`. Least-privilege Terraform roles often need many actions incl. `iam:PassRole` and tag permissions.

## Common causes

- Missing IAM action
- `iam:PassRole` missing
- Permission boundary/SCP denies
- Resource-level conditions (tags, region)
- Wrong role assumed

## Quick fix

1. Add the action to the role policy
2. Decode: `aws sts decode-authorization-message --encoded-message ...`
3. Check SCPs/boundaries and the assumed role

## Detailed fix by platform

### AWS

1. `aws iam simulate-principal-policy --policy-source-arn ROLE_ARN --action-names ec2:RunInstances`

## How to diagnose

1. **Action** — In message?
2. **Principal** — Which role?
3. **Boundary** — SCP?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/terraform/aws-unauthorizedoperation)