Skip to main content
CloudFormation tried to create, update, or delete a resource and AWS refused the operation. The failure came from your AWS account’s configuration, permissions, or limits, not from your application code or from Fjall.

​
Why this happens

  • The deploy role lacks an IAM permission for the resource operation CloudFormation attempted.
  • A service control policy (SCP) in your AWS organisation denies the action, even though the deploy role’s own policy grants it.
  • A resource policy blocks the change. A bucket policy, KMS key policy, or similar policy attached to the resource itself can refuse the operation.

​
How to fix it

  1. Read the provider reason on the deployment’s detail page. It quotes CloudFormation verbatim and names the exact denied action, for example iam:PassRole or ec2:CreateSecurityGroup.
  2. Open the CloudFormation events for the stack and find the resource named in the failure. The event’s status reason confirms which principal was denied and on which resource.
  3. Grant the missing permission to the deploy role, or remove the SCP block. If a resource policy is the blocker, update that policy to permit the deploy role.
  4. Run fjall deploy again. CloudFormation retries the operation with the corrected permissions.

​
What Fjall shows you

The failure surfaces on the deployment’s detail page on fjall.io, in the CLI’s Error Detail block, and in the deployments list row title. The detail page carries the stable code, a per-occurrence detail sentence, the provider’s verbatim reason, and the remediation steps, along with the root cause resource from the stack analysis.

Deployment safety

How Fjall protects your stacks during a deploy.

fjall deploy

Command reference for deploying an application.

fjall releases

Inspect the state of your deployments from the CLI.

Deploy an application

The full deploy workflow from build to live.