Terraform "UnauthorizedOperation: not authorized to perform" in CI

By Daniel Zoghalchali·Latchkey

AWS rejected an API call because the CI principal -- the assumed role or access key -- has no IAM policy granting that action on that resource. This is an authorization gap, not a credential failure.

What this error means

apply fails with "UnauthorizedOperation" naming an action like ec2:RunInstances. Credentials resolved fine (the call reached AWS), but the principal is not permitted to perform it.

terraform

Error: creating EC2 Instance: operation error EC2: RunInstances,
https response error StatusCode: 403, UnauthorizedOperation: You are not
authorized to perform this operation. User: arn:aws:sts::123456789012:assumed-role/ci-deploy/ci
is not authorized to perform: ec2:RunInstances on resource ...

Common causes

IAM policy missing the action

The CI role/policy does not grant the specific action (e.g. ec2:RunInstances, iam:PassRole) the resource requires.

Permission boundary or SCP denies it

A permissions boundary on the role, or an organization SCP, explicitly denies the action even if an attached policy allows it.

How to fix it

Grant the missing action to the CI role

Add the exact action named in the error to the CI principal policy (scoped to the needed resources).

ci-policy.json

{
  "Effect": "Allow",
  "Action": ["ec2:RunInstances", "ec2:CreateTags", "iam:PassRole"],
  "Resource": "*"
}

Check boundaries and SCPs

Confirm no permissions boundary on the role strips the action.
Check organization SCPs for an explicit deny.
Use aws sts get-caller-identity to confirm which principal CI uses.

How to prevent it

Scope CI roles to exactly the actions the stack needs, including companion actions.
Account for permission boundaries and SCPs in least-privilege design.
Run a plan with a dry-run identity check to catch gaps early.

Frequently asked questions

What causes ""UnauthorizedOperation""?