Docs / Cloud Accounts / Verify Permissions and Fix Common IAM Issues

Verify Permissions and Fix Common IAM Issues

Published · Last updated: June 2026 · 4 min read

Overview

If the cloud credentials you provide lack the necessary permissions, CloudAIPilot cannot manage your servers, run backups, or gather monitoring data. This article covers how to identify and fix common IAM permission issues for each provider.

How Permission Errors Surface

Because CloudAIPilot runs operations in the background, permission errors don't cause an immediate error in the browser. Instead:

  1. You approve an action (or the AI Pilot proposes one via an Approval Card and you approve it).
  2. The background task starts. If the cloud provider rejects the API call (e.g., 403 Forbidden), the Activity Center marks the task as Failed.
  3. Expanding the failed task in the Activity Center shows which step failed and why.

Run a Permission Check

Before troubleshooting manually, use the built-in permission verification tool:

  1. Go to Cloud Accounts.
  2. Click on the affected account to open the account detail panel.
  3. Click Verify Permissions.

This checks each feature category — Server Management, Cloud Storage, Networking, Monitoring, Managed Databases, and FinOps & Billing — and reports which are granted, missing, or partial. Use this to identify exactly which permissions to add in your cloud console.

Common Issues by Provider

AWS

  • External ID mismatch: AWS accounts connect via a cross-account IAM role. The External ID shown in your CloudAIPilot dashboard must exactly match the one in your AWS Trust Policy. If these differ, the connection will be rejected.
  • Missing FinOps access: FinOps data requires the AWSBillingReadOnlyAccess policy (or the individual permissions ce:GetCostAndUsage, ce:GetCostForecast, ce:GetDimensionValues). AWS Cost Explorer must also be enabled in your AWS Billing Console.

GCP

  • API not enabled: Even if the Service Account has Compute Admin rights, GCP also requires the Compute Engine API to be enabled in your project. GCP returns a 403 error for both "permission denied" and "API not enabled" — check the detailed error message to distinguish between them.
  • Service Account disabled: Check that the service account has not been disabled or deleted in the GCP IAM console.
  • Billing permissions at wrong level: The roles/billing.viewer role must be granted at the Billing Account level (GCP Console → Billing → Account Management → Permissions), not at the project level.

Azure

  • Role assigned at wrong scope: Roles must be assigned at the Subscription level. Assign Virtual Machine Contributor for server management and Cost Management Reader for FinOps data.

DigitalOcean

  • Read-only token: CloudAIPilot requires a Full Access (read + write) Personal Access Token. A read-only token allows CloudAIPilot to list resources but will fail when creating or modifying them.

Using the AI Pilot for Diagnosis

If a task fails with a permission error, open the AI Pilot chat and describe what happened — for example, "My AWS server provisioning failed with a permissions error." The AI can look at recent Activity Center logs and suggest what to check.

Related Articles