🚨 Common AWS Errors

Common AWS Errors: AWS errors are almost always one of three root causes — and recognizing the pattern saves hours of debugging.

AWS errors are almost always one of three root causes — and recognizing the pattern saves hours of debugging. Think of it like Java's exception hierarchy: `AccessDeniedException` maps to IAM permission missing (the security manager said no), `NoSuchElementException` maps to wrong region or typo (the object you expected is not in the scope you are looking at), and `OutOfMemoryError` maps to quota exceeded (the JVM's heap is the account limit). But why do these errors look so cryptic when they first hit? Because AWS API error messages describe what broke at the network/API layer, not why your intention failed — exactly like a `NullPointerException` stack trace tells you the line number but not which upstream call returned null. The QA cost of misreading an AWS error is real: a pipeline that silently fails with `AccessDenied` at the `s3:PutObject` step uploads nothing to the report bucket, the test suite appears to have run but produced no artifacts, and the team discovers 3 days later that 72 hours of CI results were lost — not because the tests failed, but because no one read the error log.

The IAM user or role does not have the required permission. The policy attached to the user is missing the "ec2:RunInstances" action.

AWS CLI or SDK cannot find credentials. The "aws configure" was never run, or credentials expired, or environment variables AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY are not set.

S3 bucket names are GLOBALLY unique across all AWS accounts worldwide. Someone (possibly you in another account) already owns this bucket name.

AMI IDs are region-specific. An AMI that exists in us-east-1 does not exist in eu-west-1. You copied an AMI ID from a tutorial targeting a different region.

New AWS accounts have a limit of 5 running EC2 instances per region. This is a safety quota to prevent unexpected bills from runaway scripts.

S3 Block Public Access is enabled by default since 2023. Even if you set object ACL to "public-read", the bucket-level Block Public Access override denies all public requests.

AWS SigV4 request signatures expire after 15 minutes. If your system clock is wrong by more than 5 minutes, all AWS API calls fail with this error.

The EC2 Security Group (firewall) does not have an inbound rule allowing SSH (port 22) from your IP. By default, all inbound traffic is blocked.

AWS API has rate limits per service per account. Calling EC2 DescribeInstances in a tight loop, or uploading thousands of S3 objects in parallel without exponential backoff triggers throttling.

🎬 The Silent AccessDenied: How 72 Hours of CI Results Vanish

AccessDenied (silent)

The CI pipeline runs every night and looks "successful" — the tests genuinely passed.

In the last step, the report tries to upload to S3 — s3:PutObject is called.