Missing IAM Permissions to Create SP-API Role – How to Request Admin Access?

To identify the administrator of your AWS account, you can try the following approaches:

1. Check your account information by clicking on your name/role in the upper right corner of the AWS Management Console, then select "Account." This page should include contact information for the account.

2. If you have access to view IAM users, look for users assigned roles with "Admin" in the name, as this is a likely place to identify administrators.

For alternative approaches to request permissions:

1. If your account is part of AWS Organizations, you might be able to identify the management account. In AWS Organizations, there's typically a role called OrganizationAccountAccessRole or AWSControlTowerExecution that administrators from the management account can assume to access member accounts.

2. You cannot create IAM roles without the proper permissions. There's no self-service way to elevate your permissions without administrator intervention.

The trust policy you've provided for the SP-API role looks correct, with the service principal set to "sellingpartner.amazonaws.com" and the sts:AssumeRole action. However, you'll need to work with an administrator who has the necessary IAM permissions to create this role for you.

Unfortunately, without admin contact or sufficient permissions, you'll need to continue trying to reach your team's AWS administrator or find someone else in your organization who has the required permissions to help you create the role.
Sources
Creating OrganizationAccountAccessRole for an invited account with AWS Organizations - AWS Organizations
Troubleshoot AWS Control Tower role error | AWS re:Post
Request for Assistance | AWS re:Post
Use CreateRole with an AWS SDK or CLI - AWS Identity and Access Management