Fix Terraform Error - AssumeRole AccessDenied
Fix the Terraform AssumeRole AccessDenied error for cross-account deployments. Covers trust policies, STS permissions, MFA, and external ID configuration.
Troubleshooting
Fix the Terraform InvalidAMIID.NotFound error. Covers region-specific AMIs, data source lookups, deregistered images, and cross-account AMI sharing.
The AMI ID doesn't exist in the target region. AMIs are region-specific — an AMI ID from us-east-1 won't work in eu-west-1. Use a data source to dynamically look up the latest AMI, or verify the AMI exists with aws ec2 describe-images.
Error: creating EC2 Instance: InvalidAMIID.NotFound:
The image id '[ami-0abcdef1234567890]' does not existError: Error launching source instance: InvalidAMIID.Malformed:
Invalid id: "ami-12345"AMIs are region-specific. The same Ubuntu AMI has different IDs in every region.
AWS or the AMI owner removed the image. Older AMIs get deregistered when new versions are released.
Using a static AMI ID that became invalid after a region change or AMI deregistration.
The AMI exists but belongs to another account and hasn't been shared with yours.
AMI IDs follow the pattern ami- followed by 17 hex characters. A wrong character returns NotFound.
data "aws_ami" "ubuntu" {
most_recent = true
owners = ["099720109477"] # Canonical
filter {
name = "name"
values = ["ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"]
}
filter {
name = "virtualization-type"
values = ["hvm"]
}
}
resource "aws_instance" "web" {
ami = data.aws_ami.ubuntu.id # Always valid
instance_type = "t3.micro"
}# AWS maintains SSM parameters with latest AMI IDs
data "aws_ssm_parameter" "al2023" {
name = "/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64"
}
resource "aws_instance" "web" {
ami = data.aws_ssm_parameter.al2023.value
instance_type = "t3.micro"
}# Check if AMI exists in your region
aws ec2 describe-images --image-ids ami-0abcdef1234567890 --region us-east-1
# Find the latest Ubuntu AMI in your region
aws ec2 describe-images --owners 099720109477 \
--filters "Name=name,Values=ubuntu/images/hvm-ssd/ubuntu-jammy*amd64*" \
--query 'Images | sort_by(@, &CreationDate) | [-1].[ImageId,Name]' \
--output text --region us-east-1
# Check if AMI is shared with your account
aws ec2 describe-images --executable-users self --image-ids ami-xxxvariable "ami_map" {
type = map(string)
default = {
us-east-1 = "ami-0abcdef1234567890"
us-west-2 = "ami-0fedcba0987654321"
eu-west-1 = "ami-0111222333444555a"
}
}
data "aws_region" "current" {}
resource "aws_instance" "web" {
ami = var.ami_map[data.aws_region.current.name]
instance_type = "t3.micro"
}ami- + 17 hex chars)aws ec2 describe-images)most_recent = true with owners to always get the latest valid AMIInvalidAMIID.NotFound means the AMI doesn't exist in your region, was deregistered, or isn't shared with your account. Replace hardcoded AMI IDs with data source lookups or SSM parameters to automatically get the latest valid AMI for any region.
Fix the Terraform AssumeRole AccessDenied error for cross-account deployments. Covers trust policies, STS permissions, MFA, and external ID configuration.
Fix the Terraform IAM EntityAlreadyExists error for roles, users, and policies. Covers import, unique naming, cross-workspace coordination, and cleanup.
Fix the Terraform 'Backend configuration changed' error. Migrate state between backends (local to S3, S3 to S3), resolve lock conflicts
Fix Terraform provider version conflicts between modules, lock files, and constraint mismatches. Resolve dependency lock errors, upgrade providers safely