(AccessDenied) when calling the CreateChangeSet operation:

The error message you're encountering suggests that there is an explicit deny in an identity-based policy that is overriding the allow permissions you've set for CloudFormation actions. In AWS, an explicit deny always takes precedence over an allow.

Even though you have a policy that allows various CloudFormation actions, including CreateChangeSet, there appears to be another policy attached to your IAM user or to a group you're a member of that explicitly denies this action.

To resolve this issue, you should:

1. Review all policies attached to your IAM user, including any group policies.
2. Look for any policy statements that explicitly deny CloudFormation actions, particularly CreateChangeSet.
3. If you find such a deny statement, you'll need to modify or remove it, or work with your AWS account administrator to do so.
4. Also, check if there are any Service Control Policies (SCPs) in place if your account is part of an AWS Organization, as these can also restrict actions.

Remember that IAM policies are additive, but an explicit deny in any policy will override allows in other policies. It's important to carefully review and manage all policies affecting your user to ensure you have the intended permissions.

If you're unable to locate the source of the deny, or if you don't have permissions to modify the relevant policies, you may need to escalate this to your AWS account administrator or someone with higher-level IAM permissions to investigate and resolve the conflicting policies.
Sources
How do I troubleshoot when User: arn is no authorized to perform Create * or Delete * or Update * on resource(s) because no identity- policy allows the actions | AWS re:Post
Troubleshoot permissions issues in Amazon ECS | AWS re:Post

Hello.

Is there an IAM policy that denies "cloudformation:CreateChangeSet"?
Judging from the error message, it looks like the IAM user policy is denying the access.
An explicit Deny policy takes precedence over an Allow policy, so if you have any Deny statements in place, try removing them.
https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html

• An explicit denial occurs when a policy contains a Deny statement for the specific AWS action.

• An implicit denial occurs when there is no applicable Deny statement and also no applicable Allow statement. Because an IAM policy denies an IAM principal by default, the policy must explicitly allow the principal to perform an action. Otherwise, the policy implicitly denies access. For more information, see The difference between explicit and implicit denies.

I think the IAM user you using have DENY on cloudformation:CreateChangeSet or cloudformation:* permission. You can easily check if that's the case or not by using AWS Policy Simulator on your account - https://policysim.aws.amazon.com/ . This toll will tell you whether you have the required permission and if not then what's blocking it.

AWS Policy Simulator: https://policysim.aws.amazon.com/