What permissions do I need when I want to use the DescribeStacks API call?

Short description

You might receive the following error when you run the DescribeStacks AWS Command Line Interface (AWS CLI) command:

"An error occurred (AccessDenied) when calling the DescribeStacks operation: User: arn:aws:sts::#AccountId:assumed-role/#RoleName/xxx is not authorized to perform: cloudformation:ListStacks on resource: arn:aws:cloudformation:us-east-1:#AccountId:stack/*/* because no identity-based policy allows the cloudformation:ListStacks action" error appears when role "#RoleName" does not have the "cloudformation:ListStacks" action."

Note: If you receive errors when you run the AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

You might see the corresponding "Failed to load stacks" error when you use the AWS Management Console. To verify that it's a permission-related issue, check the AWS CloudTrail events, and then filter for the ListStacks API call.

Resolution

The error described earlier occurs when the role doesn't have the required permission to perform a cloudformation:ListStacks action.
Note: The DescribeStacks permission also requires permission to ListStacks, if no stack name is specified.

Update the permissions policy to allow access to ListStacks

Complete the following steps on the AWS Management Console to modify the role's permissions policy:

1. Log in to the AWS Management Console as an administrator.

2. Enter IAM in the search bar. Under Services, select IAM as the service on the AWS Management Console.

3. In the left navigation pane, select the Roles tab.

4. Enter the role name in the search bar and choose the role name hyperlink (highlighted in blue).

5. Under the Permissions tab, choose the + icon for any one of the customer managed policy types or customer inline policies. Then, choose the Edit button. For more information, see Editing IAM policies.

6. Review the Modify permissions in #PolicyName webpage. Make sure that it includes cloudformation:ListStacks. The updated policy looks similar to this:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "VisualEditor",
         "Effect": "Allow",
         "Action": [
           "cloudformation:DescribeStacks",
           "cloudformation:ListStacks"
         ],
         "Resource": "*"
       }
     ]
   }

7. Choose Next. Then, choose the Save changes button to implement the policy changes.

8. Test the aws cloudformation describe-stacks command to make sure it runs successfully.

Related information

DescribeStacks

describe-stacks

ListStacks