Missing IAM Permissions to Create SP-API Role – How to Request Admin Access?

Question

**Issue**

Context: This follows up on my previous thread about the [https://repost.aws/de/questions/QUsVAePDECR9S7E1lEsTv04w/invalid-principal-in-policy-when-creating-sp-api-role-despite-correct-service-sellingpartner-amazonaws-com]() "Invalid principal" error. The core issue is now resolved, but I’ve hit a new roadblock: insufficient IAM permissions.

I need to create an IAM role for SP-API (trust policy below), but my IAM user lacks permissions (iam:CreateRole). Our team’s AWS admin is unavailable, and I only have Basic Support.
**
Question:**

How can I identify the admin of my AWS account (e.g., via IAM user list or billing page)?

Are there alternative approaches to request permissions without admin contact (e.g., AWS Organizations, SSO)?

**Trust Policy (verified working):**
json

```
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "sellingpartner.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}
```

**Why This Matters**

Blocked on SP-API integration until role is created.

Need guidance on AWS account governance when admin access is unclear.

re:Post Agent · Answer

To identify the administrator of your AWS account, you can try the following approaches:

1. Check your account information by clicking on your name/role in the upper right corner of the AWS Management Console, then select "Account." This page should include contact information for the account.

2. If you have access to view IAM users, look for users assigned roles with "Admin" in the name, as this is a likely place to identify administrators.

For alternative approaches to request permissions:

1. If your account is part of AWS Organizations, you might be able to identify the management account. In AWS Organizations, there's typically a role called `OrganizationAccountAccessRole` or `AWSControlTowerExecution` that administrators from the management account can assume to access member accounts.

2. You cannot create IAM roles without the proper permissions. There's no self-service way to elevate your permissions without administrator intervention.

The trust policy you've provided for the SP-API role looks correct, with the service principal set to "sellingpartner.amazonaws.com" and the sts:AssumeRole action. However, you'll need to work with an administrator who has the necessary IAM permissions to create this role for you.

Unfortunately, without admin contact or sufficient permissions, you'll need to continue trying to reach your team's AWS administrator or find someone else in your organization who has the required permissions to help you create the role.  
**Sources**  
[Creating OrganizationAccountAccessRole for an invited account with AWS Organizations - AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_create-cross-account-role.html)  
[Troubleshoot AWS Control Tower role error | AWS re:Post](https://repost.aws/knowledge-center/aws-control-tower-role-troubleshoot)  
[Request for Assistance | AWS re:Post](https://repost.aws/questions/QUvTIRo6lMSiGrtNWTbMDWFg/request-for-assistance)  
[Use CreateRole with an AWS SDK or CLI - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/iam_example_iam_CreateRole_section.html)

Missing IAM Permissions to Create SP-API Role – How to Request Admin Access?

Add your answer

Relevant content