Unable to Create an Amplify App, Even with Full Access

Hello.

Judging from the error message, it looks like you're explicitly denying the action.
Have you added any deny actions using custom policies other than AdministratorAccess?
https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html

Also, please check that the access is not denied not only by IAM policies but also by Organizations SCPs, etc.
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

The error you're encountering with AWS Amplify appears to be related to IAM role trust relationships, which can occur even when using accounts with full access permissions.

Based on the error message, the issue is likely that Amplify is unable to assume the specified IAM role during deployment. This happens when the trust relationship for the IAM role is not properly configured, even if the role has all the necessary permissions policies attached.

To resolve this issue, I recommend checking and updating the trust policy of the IAM role you're using with Amplify. The trust policy should include both the regional Amplify service and the general Amplify service. Your trust policy should look similar to:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": ["amplify.YOUR-REGION.amazonaws.com", "amplify.amazonaws.com"]
},
"Action": "sts:AssumeRole"
}
]
}

Make sure to replace "YOUR-REGION" with your specific AWS region.

Other troubleshooting steps to consider:

1. Verify that the IAM role has the necessary permissions attached (AdministratorAccess and AdministratorAccess-Amplify are typically recommended)
2. Check for any inline policies that might be restricting access
3. Ensure all AWS resources related to your Amplify app are in the same region
4. Review CloudTrail logs for any denied API calls related to AssumeRole actions
5. If you're using a security token, check if it has expired and needs to be refreshed

This issue can sometimes occur even with full access permissions because the trust relationship is a separate configuration from the permission policies.
Sources
Unable to Assume IAM Role in AWS Amplify Deployment | AWS re:Post
on amplify react app deploy issue | AWS re:Post
Amplify Error - Unable to assume IAM Role | AWS re:Post