Crossplane managed resource "AccessDenied" (AWS) in CI

By Kaveh Alemi·Latchkey

The provider authenticated to AWS but the API rejected the create/update call with AccessDenied. Authentication worked; authorization did not, because the IAM role or user lacks the action on that resource.

What this error means

A managed resource stays SYNCED False with a ReconcileError whose message contains "AccessDenied" and the specific AWS action that was refused.

cannot create the external resource: operation error S3: CreateBucket,
https response error StatusCode: 403, api error AccessDenied:
User: arn:aws:sts::111122223333:assumed-role/crossplane/... is not authorized to
perform: s3:CreateBucket

Common causes

The IAM policy is missing the required action

The role or user the provider assumes has no statement allowing the action (for example s3:CreateBucket) on the target resource.

A resource or condition constraint blocks the call

The action is allowed only on certain ARNs or under conditions the request does not meet, so it is denied.

How to fix it

Grant the missing IAM action

1. Read the exact action and ARN in the AccessDenied message.
2. Add an allow statement for that action to the provider role policy.
3. Reconcile the resource again after the policy propagates.

{
  "Effect": "Allow",
  "Action": ["s3:CreateBucket", "s3:PutBucketTagging"],
  "Resource": "*"
}

Confirm the right identity is assumed

Verify the ProviderConfig maps to the role you granted, so the permissions apply to the identity actually making the call.

kubectl describe bucket my-bucket | sed -n '/Events/,$p'

How to prevent it

• Grant least-privilege IAM policies that cover the actions your resources need.
• Validate the provider role can perform planned actions before rollout.
• Read the denied action from the event rather than widening blindly.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation