How to fix Error creating IAM Role: AccessDenied in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 106 views

The AccessDenied error when creating an IAM Role in Terraform means your AWS credentials lack the required iam:CreateRole permission. This can be caused by insufficient IAM permissions, permission boundaries, service control policies (SCPs), or missing trust policies. Resolve it by granting the necessary IAM permissions or adjusting your policy boundaries.

Quick fix

Fixes Error creating IAM Role: AccessDenied

# Check your current identity
aws sts get-caller-identity

# Output shows the User/Role ARN you're using
# Example output:
# {
#   "UserId": "AIDAJE45Q7YFFAREXAMPLE",
#   "Account": "123456789012",
#   "Arn": "arn:aws:iam::123456789012:user/terraform-user"
# }
  1. Verify your AWS identity and permissions
  2. Check the IAM policy attached to your user/role
  3. Grant the required IAM permissions
  4. Check for permission boundaries
terraform — error
# Check your current identity
aws sts get-caller-identity
# Output shows the User/Role ARN you're using
# Example output:
# {
#   "UserId": "AIDAJE45Q7YFFAREXAMPLE",
#   "Account": "123456789012",
#   "Arn": "arn:aws:iam::123456789012:user/terraform-user"
# }
Error creating IAM Role: AccessDenied

What this error means

The AccessDenied error when creating an IAM Role indicates that your AWS credentials (the IAM user or role you're using to run Terraform) lack permission to create roles. AWS is rejecting your request to create a role because the identity you're authenticated as doesn't have the iam:CreateRole action in their identity-based policy. This is a permission issue, not a configuration issue—your Terraform code is fine, but your AWS credentials need more permissions. This commonly occurs when using IAM credentials with minimal permissions, when permission boundaries restrict your actions, when service control policies block the action at the organization level, or when your credentials are assumed from another role that lacks the necessary permissions.

Typical symptoms

  • Terraform apply fails immediately with 'Error creating IAM Role: AccessDenied'
  • Error occurs on first resource creation with aws_iam_role
  • Same error appears for all iam:CreateRole operations (roles, policies, inline policies)
  • Error mentions 'User: arn:aws:iam::... is not authorized to perform: iam:CreateRole'
  • Other AWS resources (EC2, S3, etc.) work fine, but IAM operations fail
  • terraform plan shows the role will be created, but apply fails with authorization error

Common causes

  1. IAM user/role running Terraform lacks the iam:CreateRole permission
  2. Permission boundary restricts the iam:CreateRole action
  3. Service Control Policy (SCP) in AWS Organization blocks IAM role creation
  4. Cross-account role assumption is missing sts:AssumeRole permission
  5. IAM credentials have expired or are invalid
  6. Role trust policy is incorrect and prevents assuming the Terraform execution role
  7. Using temporary security credentials with a session that lacks iam:CreateRole

How to fix "Error creating IAM Role: AccessDenied"

1Verify your AWS identity and permissions

First, check which AWS identity you're authenticated as and what permissions it has:

bash
# Check your current identity
aws sts get-caller-identity

# Output shows the User/Role ARN you're using
# Example output:
# {
#   "UserId": "AIDAJE45Q7YFFAREXAMPLE",
#   "Account": "123456789012",
#   "Arn": "arn:aws:iam::123456789012:user/terraform-user"
# }

Note the ARN—this is the identity that needs the iam:CreateRole permission.

2Check the IAM policy attached to your user/role

Check what permissions are attached to your credentials:

bash
# If using an IAM user
aws iam list-user-policies --user-name terraform-user
aws iam list-attached-user-policies --user-name terraform-user

# If using a role
aws iam list-role-policies --role-name terraform-role
aws iam list-attached-role-policies --role-name terraform-role

# View a specific policy
aws iam get-user-policy --user-name terraform-user --policy-name policy-name

Look for "iam:CreateRole" in the policy Actions. If it's missing, that's the problem.

3Grant the required IAM permissions

Add the necessary IAM permissions to your user or role. Your AWS administrator should attach a policy like this:

json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:GetRole",
        "iam:PassRole",
        "iam:TagRole",
        "iam:UntagRole",
        "iam:UpdateRole",
        "iam:AttachRolePolicy",
        "iam:DetachRolePolicy",
        "iam:PutRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:ListRolePolicies",
        "iam:ListAttachedRolePolicies"
      ],
      "Resource": "*"
    }
  ]
}

For least privilege, restrict the Resource to your account's roles only:

json
"Resource": "arn:aws:iam::ACCOUNT_ID:role/*"
4Check for permission boundaries

Permission boundaries can restrict actions even if your identity-based policy allows them:

bash
# Check if your user/role has a permission boundary
aws iam get-user --user-name terraform-user
aws iam get-role --role-name terraform-role

# Look for "PermissionsBoundary" in the output
# If present, check what it allows
aws iam get-policy --policy-arn arn:aws:iam::ACCOUNT:policy/boundary-policy
aws iam get-policy-version --policy-arn arn:aws:iam::ACCOUNT:policy/boundary-policy --version-id v1

If a permission boundary exists and doesn't include iam:CreateRole, ask your AWS administrator to update it.

5Check for Service Control Policies (SCPs)

If you're in an AWS Organization, SCPs at the organization or account level can block IAM actions:

bash
# This requires organizational permissions, but check with your organization admin
# SCPs are managed through AWS Organizations console or:
aws organizations list-policies --filter SERVICE_CONTROL_POLICY

# Check which SCPs are attached to your account
aws organizations list-accounts-for-parent --parent-id r-xxx

If SCPs block iam:CreateRole, contact your organization administrator to request an exemption or policy update.

6If using cross-account roles, verify trust policy

If your Terraform credentials come from assuming a role in another account:

bash
# Check the role you're assuming
aws iam get-role --role-name terraform-role

# Check its assume_role_policy (trust policy)
aws iam get-role-policy --role-name terraform-role --policy-name AssumeRolePolicy

Your terraform AWS provider should have assume_role configured:

hcl
provider "aws" {
  region = "us-east-1"

  assume_role {
    role_arn = "arn:aws:iam::ACCOUNT_ID:role/terraform-role"
  }
}

Ensure the terraform-role trust policy allows your source account/user to assume it.

7Verify AWS credentials are valid

Temporary credentials may expire or be invalid:

bash
# Check credential expiration (if using temporary credentials)
aws sts get-session-token

# Try a simple AWS API call to verify credentials work
aws s3 ls

# If that fails, refresh your credentials:
# - For AWS CLI: aws configure or update ~/.aws/credentials
# - For environment variables: export AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
# - For temporary credentials: get new credentials from your identity provider

If credentials are stale or wrong, update them and retry terraform apply.

8Decode error details for more information

AWS sometimes provides encoded error details. If your error message includes an "Encoded authorization failure message", decode it:

bash
aws sts decode-authorization-message \
  --encoded-message '<really-long-encoded-string>' \
  --query DecodedMessage \
  --output text

This shows exactly what resource, action, and conditions were denied, helping pinpoint the exact permission or boundary causing the issue.

Advanced notes

Least Privilege: Only grant iam:CreateRole if your Terraform configurations actually need to create roles. If Terraform only manages existing roles, use iam:UpdateRole, iam:AttachRolePolicy, and iam:PutRolePolicy instead.

Permission Boundaries: Permission boundaries are a best practice for limiting the maximum permissions a role can have. If you hit this issue, work with your security team to understand the boundary's intent and request an update if needed.

Service Control Policies: SCPs are a powerful but restrictive governance tool in AWS Organizations. If your organization blocks iam:CreateRole, escalate to your organization administrator or see if you need an exemption for infrastructure automation.

Session Tokens: If using temporary credentials (from STS, SSO, or AWS IAM Identity Center), ensure your session hasn't expired and has the right scope. Short-lived tokens may expire between terraform plan and terraform apply.

Cross-Account Access: For multi-account setups, always test that:
1. Your source account/user can assume the terraform role
2. The terraform role has the necessary permissions
3. Both identity-based and resource-based policies (trust relationship) are correct

Terraform AWS Provider Version: Very old versions of the AWS provider may have bugs around permission handling. Update if you're using provider version < 5.0:

hcl
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

Frequently asked questions

What does "Error creating IAM Role: AccessDenied" mean?
The AccessDenied error when creating an IAM Role indicates that your AWS credentials (the IAM user or role you're using to run Terraform) lack permission to create roles. AWS is rejecting your request to create a role because the identity you're authenticated as doesn't have the iam:CreateRole action in their identity-based policy. This is a permission issue, not a configuration issue—your Terraform code is fine, but your AWS credentials need more permissions.
How do I fix "Error creating IAM Role: AccessDenied"?
The AccessDenied error when creating an IAM Role in Terraform means your AWS credentials lack the required iam:CreateRole permission. This can be caused by insufficient IAM permissions, permission boundaries, service control policies (SCPs), or missing trust policies. Resolve it by granting the necessary IAM permissions or adjusting your policy boundaries.
What causes "Error creating IAM Role: AccessDenied"?
IAM user/role running Terraform lacks the iam:CreateRole permission Permission boundary restricts the iam:CreateRole action Service Control Policy (SCP) in AWS Organization blocks IAM role creation
Is the "Error creating IAM Role: AccessDenied" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading