AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
How to resolve the "AWSServiceRoleForSSO doesn't have permission to perform the operation ..." error caused by a failed landing zone update
This article covers how to analyze and resolve the cause when you see a message reporting that a landing zone update failed because of a permissions problem with the AWSServiceRoleForSSO role.
Error
The AWS Control Tower dashboard shows the following error and account provisioning does not complete.
AWS Control Tower was unable to complete account provisioning as the assumed role, AWSServiceRoleForSSO, doesn't have permission to perform the operation "<api-action> on resource: arn:aws:sso:::account/111122223333 with an explicit deny in an identity-based policy". To continue, navigate to IAM and verify that the role AWSServiceRoleForSSO is listed under AccessManagement/Roles and its policy is up-to-date, then try again. For more information, see https://docs.aws.amazon.com/singlesignon/latest/userguide/using-service-linked-roles.html
A different API action is reported for <api-action> depending on the case, and even when the reported API differs, the cause and the resolution are the same.
Even if you follow the guidance in the error message and check the AWSServiceRoleForSSO service-linked role (SLR) in the IAM console, the role and its policy are in a healthy state and you cannot find the cause.
Root cause analysis
This error surfaces on the dashboard when a landing zone update fails. In other words, the trigger is a landing zone update left in a failed state, not a problem with account provisioning itself.
What to note here is that the AWSServiceRoleForSSO that appears in the message is text that Control Tower generates while wrapping the underlying error.
Because the principal that was actually denied is not reported verbatim in the message, following the message and checking only the service-linked role will not lead you to the cause, and it creates confusion.
The actual cause is a permissions and policy problem on the principal that performs the landing zone update. If an inline policy attached to the principal that performs the landing zone update denies an API that is called during the landing zone update, the update can fail.
Resolution
1. Remove the deny policy that causes the problem
If a policy attached to the IAM identity of the principal that ran the landing zone update denies APIs required for the landing zone update, you must delete those policies.
2. Retry the landing zone update (required)
Removing the policy alone leaves the error on the dashboard as it is. A landing zone left in a failed state cannot be recovered by any means other than a retry (update or reset), so you must perform the retry.
- Open the AWS Control Tower console
- Go to Landing zone settings
- Run the retry (retry the landing zone update)
- The issue is resolved once the landing zone update retry completes successfully
Related documentation
- Topics
- Management & Governance
- Language
- English
