What causes "AWS 'Not Authorized to Perform' IAM Error"?

No identity-based policy allows the action (implicit deny) Explicit Deny somewhere Service control policy or resource control policy Permissions boundary Session policy on assumed role Resource-based policy or role trust policy missing the principal Expired temporary credentials

How do I fix "AWS 'Not Authorized to Perform' IAM Error"?

1. Read the suffix of the error: 'because no identity-based policy allows ...': add an Allow 'with an explicit deny in a ... policy': find that Deny Policy type can be service control, resource control, VPC endpoint, permissions boundary, session, resource-based or role trust 2. Add the missing permission: IAM > Users or Roles > Permissions > Add permissions Grant the exact action (for example lambda:InvokeFunction) on the resource ARN, with least privilege 3. Check other policy layers: Permissions boundary on the principal SCPs via AWS Organizations Role trust policy for sts:AssumeRole 4. Rule out credentials problems: aws sts get-caller-identity to confirm which identity you use Refresh expired temporary credentials 5. Ask an admin: In the console the message means you need an administrator to change your policies

AWS 'Not Authorized to Perform' IAM Error

Ongoing Console, CLI, SDK Updated November 13, 2026Based on 5 user reportsHow we research

Quick answer

The error text says who, which action and why: add an Allow for that action on the resource, or remove the explicit deny in the SCP, permissions boundary, session policy or resource policy it names.

Most likely fix: Read the suffix of the error

How to fix it

Try these in order — the most common fix is first.

1. Read the suffix of the error
1. 'because no identity-based policy allows ...': add an Allow
2. 'with an explicit deny in a ... policy': find that Deny
3. Policy type can be service control, resource control, VPC endpoint, permissions boundary, session, resource-based or role trust
Did this fix it?
2. Add the missing permission
1. IAM > Users or Roles > Permissions > Add permissions
2. Grant the exact action (for example lambda:InvokeFunction) on the resource ARN, with least privilege
Did this fix it?
3. Check other policy layers
1. Permissions boundary on the principal
2. SCPs via AWS Organizations
3. Role trust policy for sts:AssumeRole
Did this fix it?
4. Rule out credentials problems
1. aws sts get-caller-identity to confirm which identity you use
2. Refresh expired temporary credentials
Did this fix it?
5. Ask an admin
1. In the console the message means you need an administrator to change your policies
Did this fix it?