Not authorized to perform cloudformation DescribeStacks despite AdministratorAccess [Serverless, Lambda, IAM]

user_16145608 0
Viewed 1394

I tried to deploy using the following command.

sls deploy --stage=stage --profile=[my-profile]

And it gives the error.

Serverless Error ----------------------------------------
 
  User: arn:aws:iam::[my-iam-user] is not authorized to perform: cloudformation:DescribeStacks on resource: arn:aws:cloudformation:ap-northeast-1:[my-lambda-endpoint]/* with an explicit deny

My IAM user has AdministratorAccess policy, so I can't understand why the error occured

aws-lambda serverless-framework
1 Answers

If you really have admin privileges for that user, there's only one way those can be restricted and this only applies when you're in a member account of AWS organizations: Service Control Policies. SCPs can be used by the management account to restrict access to certain regions or services.

If you're not in an AWS organizations member account and getting this error, you probably do not have the permissions you think you have with that user.

user_9074800
Related