When a CloudFormation stacks fails to deploy due to missing permissions, you'll get more or less useful error messages.
In my case, my CI pipeline deploys a CloudFormation template for a web application, including a S3 bucket, a CloudFront distribution and some other resources. The CI uses a IAM user.
Most times this works fine, however, sometimes my CI user gets an error like this:
The following resource(s) failed to update: [CloudFrontDistribution].
Resource handler returned message: "Access denied for operation 'AWS::CloudFront::Distribution'."
(RequestToken: 1014641b-7590-f7b3-2ea2-1ddcd32e92a3, HandlerErrorCode: AccessDenied)
In order to give my CI IAM user as narrow permission set as possible, I wanted to know exactly what's required. However, the error message above doesn't specify any IAM action; in fact the message is quite cryptic saying that the failed operation is AWS::CloudFront::Distribution (which is a resource type, not an operation or IAM action).
I went to CloudTrail to see if I could find an event with an AccessDenied error for this user, but with no luck. I could only see a ExecuteChangeSet action which from CloudTrail's point of view was successful.
Since I couldn't find any more details in any logs and I didn't want to play trial and error with 50+ actions that may or may not be needed, eventually I gave up and added CloudFront:* to my IAM user's permission set. However, this bothers me; I'd like to understand what was required instead of taking the wildcard route, since doing so creates way too broad permissions, which in turn is bad security practice.
Is there a way to find out more details about why a CF template failed to deploy when the reason is insufficient permissions, such as in the case above?