title: Given a failed AWS API request, how can I debug what permissions I need?
body: <p>I'm using Terraform to provision some resources on AWS. Running the "plan" step of Terraform fails with the following vague error (for example):</p>
  
  <pre><code>Error: Error loading state: AccessDenied: Access Denied
          status code: 403, request id: ABCDEF12345678, host id: SOMELONGBASE64LOOKINGSTRING===
  </code></pre>
  
  <p>Given a request id and a host id is it possible to see more in depth what went wrong?</p>
  
  <p>Setting TF_LOG=DEBUG (or some other level) seems to help, but I was curious if there is a CLI command to get more information from CloudTrail or something.</p>
  
  <p>Thanks!</p>