Struggling with AccessDenied Error Despite Full Access for CloudFormation Stack

Question

Hi AWS Community,

I'm reaching out for help with a frustrating issue I've been facing. Despite granting full access to CloudFormation stacks, I'm still encountering an AccessDenied error. This is really impacting my deployment process, and I'm struggling to figure out what might be going wrong.

Here's a brief overview of the situation:
1. IAM Policy: I have a policy that grants full access to CloudFormation actions and resources. The policy looks like this:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SAMDeployCloudFormation",
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateChangeSet",
                "cloudformation:DescribeChangeSet",
                "cloudformation:ExecuteChangeSet",
                "cloudformation:DescribeStacks"
            ],
            "Resource": [
                "arn:aws:cloudformation:ap-south-1::stack/aws-sam-cli-managed-default/*",
                "arn:aws:cloudformation:ap-south-1:aws:transform/Serverless-2016-10-31"
            ]
        },
        {
            "Sid": "SAMDeployCloudFormationFullAccess",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:cloudformation:ap-south-1::stack/aws-sam-cli-managed-default/*"
                }
            }
        }
    ]
}

```
2. CloudTrail Event Log:

```
{
    "eventVersion": "1.09",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AIDA4MTWHLCH7XAVMZPVY",
        "arn": "arn:aws:iam:::user/",
        "accountId": "",
        "accessKeyId": "ASIA4MTWHLCHW5KQB3MV",
        "userName": "",
        "sessionContext": {
            "attributes": {
                "creationDate": "2024-08-14T08:37:47Z",
                "mfaAuthenticated": "false"
            }
        },
        "invokedBy": "cloudformation.amazonaws.com"
    },
    "eventTime": "2024-08-14T08:37:52Z",
    "eventSource": "s3.amazonaws.com",
    "eventName": "CreateBucket",
    "awsRegion": "ap-south-1",
    "sourceIPAddress": "cloudformation.amazonaws.com",
    "userAgent": "cloudformation.amazonaws.com",
    "errorCode": "AccessDenied",
    "errorMessage": "Access Denied",
    "requestParameters": {
        "CreateBucketConfiguration": {
            "LocationConstraint": "ap-south-1",
            "xmlns": "http://s3.amazonaws.com/doc/2006-03-01/"
        },
        "bucketName": "aws-sam-cli-managed-default-samclisourcebucket-rcekmruyslgl",
        "Host": "aws-sam-cli-managed-default-samclisourcebucket-rcekmruyslgl.s3.ap-south-1.amazonaws.com",
        "x-amz-acl": "bucket-owner-full-control"
    },
    "responseElements": null,
    "additionalEventData": {
        "SignatureVersion": "SigV4",
        "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
        "bytesTransferredIn": 192,
        "AuthenticationMethod": "AuthHeader",
        "x-amz-id-2": "Gmdsb47WoXYj86HgW52XChlVenj8h90sR6Yd7EnaBBbZjvwfh+TDh4d4mAK1lzChnhijFI/KJok=",
        "bytesTransferredOut": 243
    },
    "requestID": "J5BP3BVYT0RRNY8V",
    "eventID": "688b5cac-2bcc-44f0-99f3-c1943161ebc6",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "",
    "eventCategory": "Management"
}
```

**What I've Tried:**
1. Verified the IAM policy and ensured it grants full access to CloudFormation actions and resources.
2. Checked CloudFormation permissions and conditions.
3. Reviewed S3 bucket policies and ACLs.

**What I'm Looking For:**

I need to understand why I'm still getting an AccessDenied error despite granting what seems like full access. Any insights or suggestions on what might be missing or incorrect would be greatly appreciated!

Thank you in advance for your help.

Steve_M · Answer

Create a role that CloudFormation can assume, and attach to this role a permissions policy that contains sufficient privileges to create an S3 bucket.

In the CloudFormation template, specify the IAM role using the **RoleARN** property for the `AWS::CloudFormation::Stack` resource.
```
RoleARN: arn:aws:iam:::role/MyCloudFormationRole 
```

Riku_Kobayashi · Answer

Hello.

Looking at CloudTrail events, it appears that creation of the S3 bucket to store the CloudFormation template has failed.  
So, why not try adding a policy for operating S3 as shown below?  
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SAMDeployCloudFormation",
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateChangeSet",
                "cloudformation:DescribeChangeSet",
                "cloudformation:ExecuteChangeSet",
                "cloudformation:DescribeStacks"
            ],
            "Resource": [
                "arn:aws:cloudformation:ap-south-1::stack/aws-sam-cli-managed-default/*",
                "arn:aws:cloudformation:ap-south-1:aws:transform/Serverless-2016-10-31"
            ]
        },
        {
            "Sid": "SAMDeployCloudFormationFullAccess",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:cloudformation:ap-south-1::stack/aws-sam-cli-managed-default/*"
                }
            }
        },
        {
            "Sid": "S3",
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": "*"
        }
    ]
}
```

Struggling with AccessDenied Error Despite Full Access for CloudFormation Stack

Add your answer

Relevant content