title: Error while deploying MWAA using Cloudformation
body: <p>I am getting the following error while deploying Managed Workflow using Apache Airflow using Cloudformation. The error doesnt give out much information and hence difficult to debug</p>
  <blockquote>
  <p>2022-09-16 15:25:42 UTC+0530  MwaaEnvironment CREATE_FAILED   Resource
  handler returned message: &quot;null (Service: Mwaa, Status Code: 403,
  Request ID: de70d88f-383a-43bb-91a7-4ebdee31223e)&quot; (RequestToken:
  fe034e51-e5e2-73e9-3616-0bd928d64a1f, HandlerErrorCode: AccessDenied)</p>
  </blockquote>
  <p>It shows access denied but not much information about which resource</p>
  <p>Snippet of Cloudformation yaml for the mwaa execution policy</p>
  <pre><code>    #####################################################################################################################
    # CREATE MWAA
    #####################################################################################################################
  
    MwaaEnvironment:
      Type: AWS::MWAA::Environment
      DependsOn: MwaaExecutionPolicy
      Properties:
        Name: !Sub &quot;${AWS::StackName}-MwaaEnvironment&quot;
        SourceBucketArn: !GetAtt EnvironmentBucket.Arn
        ExecutionRoleArn: !GetAtt MwaaExecutionRole.Arn
        DagS3Path: dags
        NetworkConfiguration:
          SecurityGroupIds:
            - !GetAtt SecurityGroup.GroupId
          SubnetIds:
            - !Ref PrivateSubnet1
            - !Ref PrivateSubnet2
        WebserverAccessMode: PUBLIC_ONLY
        MaxWorkers: !Ref MaxWorkerNodes
        LoggingConfiguration:
          DagProcessingLogs:
            LogLevel: !Ref DagProcessingLogs
            Enabled: true
          SchedulerLogs:
            LogLevel: !Ref SchedulerLogsLevel
            Enabled: true
          TaskLogs:
            LogLevel: !Ref TaskLogsLevel
            Enabled: true
          WorkerLogs:
            LogLevel: !Ref WorkerLogsLevel
            Enabled: true
          WebserverLogs:
            LogLevel: !Ref WebserverLogsLevel
            Enabled: true
    SecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
        VpcId: !Ref VPC
        GroupDescription: !Sub &quot;Security Group for Amazon MWAA Environment ${AWS::StackName}-MwaaEnvironment&quot;
        GroupName: !Sub &quot;airflow-security-group-${AWS::StackName}-MwaaEnvironment&quot;
  
    SecurityGroupIngress:
      Type: AWS::EC2::SecurityGroupIngress
      Properties:
        GroupId: !Ref SecurityGroup
        IpProtocol: &quot;-1&quot;
        SourceSecurityGroupId: !Ref SecurityGroup
  
    SecurityGroupEgress:
      Type: AWS::EC2::SecurityGroupEgress
      Properties:
        GroupId: !Ref SecurityGroup
        IpProtocol: &quot;-1&quot;
        CidrIp: &quot;0.0.0.0/0&quot;
  
    MwaaExecutionRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - airflow-env.amazonaws.com
                  - airflow.amazonaws.com
              Action:
               - &quot;sts:AssumeRole&quot;
        Path: &quot;/service-role/&quot;
  
    MwaaExecutionPolicy:
      DependsOn: EnvironmentBucket
      Type: AWS::IAM::ManagedPolicy
      Properties:
        Roles:
          - !Ref MwaaExecutionRole
        PolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action: airflow:PublishMetrics
              Resource:
                - !Sub &quot;arn:aws:airflow:${AWS::Region}:${AWS::AccountId}:environment/${EnvironmentName}&quot;
            - Effect: Deny
              Action: s3:ListAllMyBuckets
              Resource:
                - !Sub &quot;${EnvironmentBucket.Arn}&quot;
                - !Sub &quot;${EnvironmentBucket.Arn}/*&quot;
  
            - Effect: Allow
              Action:
                - &quot;s3:GetObject*&quot;
                - &quot;s3:GetBucket*&quot;
                - &quot;s3:List*&quot;
              Resource:
                - !Sub &quot;${EnvironmentBucket.Arn}&quot;
                - !Sub &quot;${EnvironmentBucket.Arn}/*&quot;
            - Effect: Allow
              Action:
                - logs:DescribeLogGroups
              Resource: &quot;*&quot;
  
            - Effect: Allow
              Action:
                - logs:CreateLogStream
                - logs:CreateLogGroup
                - logs:PutLogEvents
                - logs:GetLogEvents
                - logs:GetLogRecord
                - logs:GetLogGroupFields
                - logs:GetQueryResults
                - logs:DescribeLogGroups
              Resource:
                - !Sub &quot;arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:airflow-${AWS::StackName}*&quot;
            - Effect: Allow
              Action: cloudwatch:PutMetricData
              Resource: &quot;*&quot;
            - Effect: Allow
              Action:
                - sqs:ChangeMessageVisibility
                - sqs:DeleteMessage
                - sqs:GetQueueAttributes
                - sqs:GetQueueUrl
                - sqs:ReceiveMessage
                - sqs:SendMessage
              Resource:
                - !Sub &quot;arn:aws:sqs:${AWS::Region}:*:airflow-celery-*&quot;
            - Effect: Allow
              Action:
                - kms:Decrypt
                - kms:DescribeKey
                - &quot;kms:GenerateDataKey*&quot;
                - kms:Encrypt
              NotResource: !Sub &quot;arn:aws:kms:*:${AWS::AccountId}:key/*&quot;
              Condition:
                StringLike:
                  &quot;kms:ViaService&quot;:
                    - !Sub &quot;sqs.${AWS::Region}.amazonaws.com&quot;
            - Action:
                - cloudwatch:*
                - cloudformation:CreateStack
                - cloudformation:DescribeStackEvents
                - ec2:AuthorizeSecurityGroupIngress
                - ec2:AuthorizeSecurityGroupEgress
                - ec2:CancelSpotInstanceRequests
                - ec2:CreateRoute
                - ec2:CreateSecurityGroup
                - ec2:CreateTags
                - ec2:DeleteRoute
                - ec2:DeleteTags
                - ec2:DeleteSecurityGroup
                - ec2:DescribeAvailabilityZones
                - ec2:DescribeAccountAttributes
                - ec2:DescribeInstances
                - ec2:DescribeKeyPairs
                - ec2:DescribeRouteTables
                - ec2:DescribeSecurityGroups
                - ec2:DescribeSpotInstanceRequests
                - ec2:DescribeSpotPriceHistory
                - ec2:DescribeSubnets
                - ec2:DescribeVpcAttribute
                - ec2:DescribeVpcs
                - ec2:DescribeRouteTables
                - ec2:DescribeNetworkAcls
                - ec2:CreateVpcEndpoint
                - ec2:ModifyImageAttribute
                - ec2:ModifyInstanceAttribute
                - ec2:RequestSpotInstances
                - ec2:RevokeSecurityGroupEgress
                - ec2:RunInstances
                - ec2:TerminateInstances
                - elasticmapreduce:*
                - iam:GetPolicy
                - iam:GetPolicyVersion
                - iam:ListRoles
                - iam:PassRole
                - kms:List*
                - s3:*
                - sdb:*
              Effect: Allow
              Resource: &quot;*&quot;
            - Effect: Allow
              Action: iam:CreateServiceLinkedRole
              Resource: &quot;*&quot;
              Condition:
                StringLike:
                  iam:AWSServiceName:
                    - elasticmapreduce.amazonaws.com
                    - elasticmapreduce.amazonaws.com.cn
  </code></pre>