Serverless Framework "is not authorized to perform" / credentials error in CI

By Kaveh Alemi·Latchkey

Serverless Framework called an AWS API and IAM denied it (AccessDenied) or no credentials were found at all. The deploy needs CloudFormation, S3, IAM, and Lambda permissions under the configured identity.

What this error means

serverless deploy fails with "ServerlessError: AWS provider credentials not found" or an AccessDenied: "User: arn:... is not authorized to perform: cloudformation:CreateStack".

Error:
ServerlessError: User: arn:aws:sts::123456789012:assumed-role/gha-deployer/... is not
authorized to perform: cloudformation:DescribeStacks on resource: arn:aws:cloudformation:...

Common causes

The deploy role lacks required permissions

The principal can authenticate but its policy does not allow the CloudFormation/S3/IAM/Lambda actions the deploy performs.

No credentials configured for the provider

No env keys, profile, or assumed role were available, so Serverless reports credentials not found.

How to fix it

Configure credentials before deploy

Use OIDC to assume a deploy role so the provider has valid credentials.

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/gha-deployer
    aws-region: us-east-1
- run: npx serverless deploy --stage prod

Grant the missing IAM actions

Add the denied action (named in the error) to the deploy role policy.

{
  "Effect": "Allow",
  "Action": ["cloudformation:*","s3:*","lambda:*","iam:PassRole","logs:*"],
  "Resource": "*"
}

How to prevent it

• Use OIDC to provide short-lived deploy credentials.
• Scope a deploy policy with the actions Serverless needs.
• Verify with aws sts get-caller-identity before deploy.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation