AWS AWS IAM Error Codes

The request was rejected because the account making the request is not the management account or delegated administrator account for centralized root access.

The request was rejected because the account making the request is not the management account for the organization.

The request was rejected because multiple requests to change this object were submitted simultaneously. Wait a few minutes and submit your request again.

The request was rejected because the most recent credential report has expired. To generate a new credential report, use GenerateCredentialReport. For more information about credential report expiration, see Getting credential reports in the IAM User Guide.

The request was rejected because the credential report does not exist. To generate a credential report, use GenerateCredentialReport.

The request was rejected because the credential report is still being generated.

The request was rejected because it attempted to delete a resource that has attached subordinate entities. The error message describes these entities.

The request was rejected because the same certificate is associated with an IAM user in the account.

The request was rejected because the SSH public key is already associated with the specified IAM user.

The request was rejected because it attempted to create a resource that already exists.

The request was rejected because it referenced an entity that is temporarily unmodifiable, such as a user name that was deleted and then recreated. The error indicates that the request is likely to succeed if you try again after waiting several minutes. The error message describes the entity.

The request failed because outbound identity federation is already disabled for your Amazon Web Services account. You cannot disable the feature multiple times

The request failed because outbound identity federation is already enabled for your Amazon Web Services account. You cannot enable the feature multiple times. To fetch the current configuration (including the unique issuer URL), use the GetOutboundWebIdentityFederationInfo operation.

The request was rejected because the authentication code was not recognized. The error message describes the specific error.

The request was rejected because the certificate is invalid.

The request was rejected because an invalid or out-of-range value was supplied for an input parameter.

The request was rejected because the public key is malformed or otherwise invalid.

The request was rejected because the type of user for the transaction was incorrect.

The request was rejected because the public key certificate and the private key do not match.

The request was rejected because it attempted to create resources beyond the current Amazon Web Services account limits. The error message describes the limit exceeded.

The request was rejected because the certificate was malformed or expired. The error message describes the specific error.

The request was rejected because the policy document was malformed. The error message describes the specific error.

The request was rejected because the resulting role name conflicts with an existing role in the account.

The request was rejected because it referenced a resource entity that does not exist. The error message describes the resource.

The request failed because IAM cannot connect to the OpenID Connect identity provider URL.

The request was rejected because no organization is associated with your account.

The request was rejected because your organization does not have All features enabled. For more information, see Available feature sets in the Organizations User Guide.

The request was rejected because the provided password did not meet the requirements imposed by the account password policy.

The request failed because a provided policy could not be successfully evaluated. An additional detailed message indicates the source of the failure.

The request failed because Amazon Web Services service role policies can only be attached to the service-linked role for that service.

The request failed because the maximum number of concurrent requests for this account are already running.

The request was rejected because someone modified the role template while the service was creating the role. Wait a few minutes and try the request again.

The request was rejected because the specified role template is disabled. A disabled role template cannot be used to create new roles. Contact your administrator to enable the role template, or use a different role template.

The request was rejected because trusted access is not enabled for IAM in Organizations. For details, see IAM and Organizations in the Organizations User Guide.

The request processing has failed because of an unknown error, exception or failure.

The specified service does not support service-specific credentials.

The request was rejected because service-linked roles are protected Amazon Web Services resources. Only the service that depends on the service-linked role can modify or delete the role on your behalf. The error message includes the name of the service that depends on this service-linked role. You must request the change through that service.

The request was rejected because the public key encoding format is unsupported or unrecognized.