> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fjall.io/llms.txt
> Use this file to discover all available pages before exploring further.

# cfn.permissions

> AWS permissions blocked a resource change

CloudFormation tried to create, update, or delete a resource and AWS refused the operation. The failure came from your AWS account's configuration, permissions, or limits, not from your application code or from Fjall.

## Why this happens

* The deploy role lacks an IAM permission for the resource operation CloudFormation attempted.
* A service control policy (SCP) in your AWS organisation denies the action, even though the deploy role's own policy grants it.
* A resource policy blocks the change. A bucket policy, KMS key policy, or similar policy attached to the resource itself can refuse the operation.

## How to fix it

1. Read the provider reason on the deployment's detail page. It quotes CloudFormation verbatim and names the exact denied action, for example `iam:PassRole` or `ec2:CreateSecurityGroup`.
2. Open the CloudFormation events for the stack and find the resource named in the failure. The event's status reason confirms which principal was denied and on which resource.
3. Grant the missing permission to the deploy role, or remove the SCP block. If a resource policy is the blocker, update that policy to permit the deploy role.
4. Run `fjall deploy` again. CloudFormation retries the operation with the corrected permissions.

## What Fjall shows you

The failure surfaces on the deployment's detail page on fjall.io, in the CLI's Error Detail block, and in the deployments list row title. The detail page carries the stable code, a per-occurrence detail sentence, the provider's verbatim reason, and the remediation steps, along with the root cause resource from the stack analysis.

## Related

<CardGroup cols={2}>
  <Card title="Deployment safety" icon="shield" href="/deployment/deployment-safety">
    How Fjall protects your stacks during a deploy.
  </Card>

  <Card title="fjall deploy" icon="rocket" href="/cli/deploy">
    Command reference for deploying an application.
  </Card>

  <Card title="fjall releases" icon="magnifying-glass" href="/cli/releases">
    Inspect the state of your deployments from the CLI.
  </Card>

  <Card title="Deploy an application" icon="play" href="/deployment/deploy-application">
    The full deploy workflow from build to live.
  </Card>
</CardGroup>