AWS, Azure & GCP Errors

Understanding Cloud errors

Cloud provider errors are overwhelmingly one of two things: IAM (the caller is not permitted, or the credentials are not the ones you think) or quota (the account limit was reached). Providers deliberately return the same vague AccessDenied for a missing permission, a deny in a boundary or SCP, and a resource policy that excludes you, so the fix begins with identifying which identity made the call.

How to debug Cloud errors

1. Confirm the identity first: aws sts get-caller-identity, az account show, or gcloud auth list. An unexpectedly large share of AccessDenied errors are the right policy on the wrong principal.
2. Use the provider's policy simulator (IAM Policy Simulator, gcloud policy-troubleshoot) rather than reading policy JSON. It accounts for boundaries, SCPs and resource policies that are invisible in a single document.
3. Check CloudTrail / Activity Log / Cloud Audit Logs for the denied call. The log entry names the exact action and resource ARN, which the client-side error usually omits.
4. For quota errors, look up the current limit and the current usage before requesting an increase: many quotas are per-region and per-account, and the resource you think is idle may be counted.
5. Verify the region. A resource that "does not exist" very often exists in a different region than the one your CLI profile defaults to.

Tools worth reaching for

• aws sts get-caller-identity
• IAM Policy Simulator
• gcloud policy-troubleshoot
• CloudTrail / Activity Log

All 25 Cloud errors

• AWS CloudFormation: Stack is in ROLLBACK_COMPLETE state and can not be updated NewThe stack's first create failed and rolled back. A stack in that state has no resources and cannot be updated, only…
• AWS EC2: Instance limit exceededAccount has reached the limit for number of instances of a specific type in a region.
• AWS ECS: CannotPullContainerError, pull image manifest has been retried NewThe task could not fetch its image, and the reason is far more often networking than permissions: a task in a private…
• AWS IAM: Policy syntax errorIAM policy JSON is malformed or contains invalid actions, resources, or conditions.
• AWS Lambda: Function timeoutLambda function exceeded maximum execution time. Default is 3 seconds, max is 15 minutes.
• AWS RDS: Connection timeoutCannot connect to RDS instance. Security group blocking, wrong endpoint, or instance not publicly accessible.
• AWS S3: Access DeniedIAM permissions insufficient to access S3 bucket. Bucket policy, ACL, or IAM policy blocking access.
• AWS S3: PermanentRedirect, wrong regional endpoint NewThe request went to the wrong regional endpoint. S3 bucket names are global but buckets live in one region, and…
• AWS: AccessDenied when calling the AssumeRole operation NewRole assumption requires permission on both sides: the caller needs sts:AssumeRole in its identity policy, and the…
• AWS: ExpiredToken / The security token included in the request is expired NewTemporary credentials from STS, IAM Identity Center (SSO) or an assumed role have passed their expiry. Sessions are…
• AWS: MissingAuthenticationTokenExceptionRequest is missing valid credentials, or the specific API endpoint/region combination is incorrect.
• AWS: The security token included in the request is expired NewThe temporary credentials issued by STS have passed their expiry, which is one hour by default for an assumed role. A…
• AWS: ThrottlingException: Rate exceeded NewYou hit an AWS API request rate limit. The limits are per account, per region and per API, so a noisy deployment tool…
• Azure: Authentication failedCannot authenticate with Azure. Expired credentials, wrong tenant, or insufficient permissions.
• Azure: AuthorizationFailed, the client does not have authorization NewAzure RBAC denied the operation at the scope you targeted. Role assignments are inherited downward from management…
• Azure: MissingSubscriptionRegistration (resource provider not registered) NewAzure requires each resource provider namespace to be registered on the subscription before resources of that type can…
• Azure: Quota exceededSubscription has reached quota limit for VMs, cores, or other resources in a region.
• Azure: Resource not foundSpecified Azure resource doesn't exist or is in different resource group/subscription.
• GCP: does not have permission to act as the service account NewDeploying a resource that runs as a service account requires iam.serviceAccounts.actAs on that account, which is…
• GCP: Permission deniedService account or user lacks required IAM permissions for the operation.
• GCP: Quota exceededProject has exceeded quota for API requests, compute instances, or other resources.
• GCP: SERVICE_DISABLED (API has not been used in project before) NewGoogle Cloud APIs are disabled by default per project. The first call to a service fails until the API is enabled, and…
• Pulumi: the stack has pending operationsA previous update was interrupted, leaving operations indeterminate. Pulumi blocks further updates until state is…
• Vault: permission denied (403)The token's policies do not grant the requested path/capability, or the token expired. Vault denies by default.
• Vault: server is sealedHashiCorp Vault is sealed and cannot serve secrets. It seals on restart and must be unsealed with a quorum of unseal…

Other categories

• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Ansible 10Unreachable hosts, become passwords, undefined variables and Jinja2 failures.
• API 14Auth headers, payload limits, versioning, idempotency and webhook signatures.
• Apple 10Command line tools, dyld, Homebrew permissions, notarisation and Keychain.
• Auth 11OIDC, SAML, Auth0, Okta, Keycloak, passkeys and MFA failures.
• BigData 11Spark, Kafka, Airflow, Snowflake, Flink and Databricks failures.
• C# 12NuGet restore, null references, EF Core migrations, async deadlocks and Blazor…
• C++ 11Segfaults, linker errors, memory corruption and template deduction failures.
• Caching 10Cache stampedes, stale content, Varnish and CloudFront failures.
• CI/CD 18GitHub Actions, GitLab CI, Jenkins, CircleCI: permissions, runners and…
• Client 21CORS, mixed content, module resolution, memory limits and framework runtime…
• Dart 10Null safety, pub version solving and build toolchain problems.
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• DNS 10NXDOMAIN, SERVFAIL, timeouts, propagation and delegation problems.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• Elixir 9GenServer timeouts, supervision failures and Mix compilation problems.
• Email 8Delivery failures, relay denial, authentication, SPF, DKIM and DMARC.
• Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.
• Git 20Merge conflicts, rejected pushes, detached HEAD, LFS and repository corruption.
• Go 19Nil map assignment, concurrent map access, context cancellation and deadlocks.
• GraphQL 13Validation, depth limits, N+1 queries and fragment problems.
• gRPC 10Status codes, deadlines, message limits, TLS and HTTP/2 transport failures.
• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• ICMP 23Destination unreachable, time exceeded, fragmentation needed and redirects.
• Ingress 8404 default backend, missing TLS secrets, IngressClass and path matching.
• Java 19Class loading, dependency resolution, connection pools and JVM version…
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Logging 9Log4j, Logback, Fluentd, Logstash and CloudWatch ingestion problems.
• MessageQueue 14Kafka, RabbitMQ, SQS, NATS and Celery: lag, rebalancing and poison messages.
• Mobile 17Gradle, CocoaPods, Xcode signing, Metro bundler and toolchain mismatches.
• Monitoring 12Prometheus scrapes, Grafana data sources, OpenTelemetry exporters and agent…
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Performance 6GC pauses, thread pool starvation and event loop blocking.
• PHP 11Memory limits, execution timeouts, autoloading, Composer and PDO connections.
• Proxy 17nginx, Envoy, HAProxy, Traefik, Caddy and Cloudflare upstream failures.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Regex 8Catastrophic backtracking, back references, escaping and engine differences.
• Ruby 11Bundler, migrations, native extensions, encoding and asset compilation.
• Rust 19Borrow checker, ownership moves, trait bounds and lifetime mismatches.
• Scala 6Dependency resolution, binary compatibility and type inference failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• Serverless 11Lambda timeouts, package size limits, VPC networking and cold starts.
• Shell 13Command not found, permissions, quoting, expansion and Makefile syntax.
• Storage 13S3 permissions, NFS mounts, quotas, signed URLs and volume attachment.
• Svelte 10Store subscriptions, load functions and server/client boundaries.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Terraform 18State locks, provider auth, drift, dependency cycles and plan-time unknowns.
• Testing 18Jest, pytest, JUnit, Cypress and Playwright: fixtures, snapshots and timeouts.
• TLS 24Untrusted authorities, expiry, hostname mismatch, chains and cipher negotiation.
• TypeScript 19Assignability, missing declarations, strict null checks and generic constraints.
• Virtualization 8VirtualBox, VMware, Hyper-V, WSL, KVM and hypervisor conflicts.
• Web3 7Gas estimation, nonce management and reverted transactions.
• WebAssembly 7Compile errors, memory bounds and host binding mismatches.
• WebServer 10nginx, Apache, IIS and Caddy: binding, permissions, rewrites and TLS.
• Windows 10Installer failures, missing runtimes, update errors and permission problems.