CloudFormation "does not exist or is not authorized" in CI

By Daniel Zoghalchali·Latchkey

CloudFormation could not act on a referenced resource because the deploying principal is not authorized to use it, or the resource is not visible to that account. AWS often phrases a permission gap as "does not exist or is not authorized" to avoid leaking existence.

What this error means

A resource fails with "<arn> does not exist or is not authorized", commonly on IAM roles, KMS keys, or cross-account references during deploy.

CREATE_FAILED   AWS::Lambda::Function   ApiFn
Resource handler returned message: "The role defined for the function cannot be assumed
by Lambda. (Service: Lambda, ...)" or "... does not exist or is not authorized"

Common causes

The deploy role lacks permission on the resource

The CI principal cannot PassRole, read the KMS key, or act on the referenced ARN, so AWS reports it as missing or unauthorized.

A wrong ARN, account, or region

The reference points at a resource in another account or region, or an ARN that does not exist, so the principal cannot see it.

How to fix it

Grant the missing permission

1. Identify the resource ARN in the failure message.
2. Add the missing action (for example iam:PassRole on the function role) to the deploy role policy.
3. Redeploy so the authorized action succeeds.

{
  "Effect": "Allow",
  "Action": "iam:PassRole",
  "Resource": "arn:aws:iam::123456789012:role/api-fn-role"
}

Verify the ARN, account, and region

Confirm the referenced resource exists in the same account and region the stack deploys to; correct the ARN if it points elsewhere.

How to prevent it

• Grant least-privilege but complete permissions to the CI deploy role.
• Include iam:PassRole for roles your resources assume.
• Keep cross-account/region references explicit and verified.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation