SAM Deploy Blocked

[desert-digital]

I am using Visual Studio Code and the AWS Toolkit.

I have two account (for different projects), let's call them account_number_1 and account_number_2, and I am unable to deploy my SAM project to the second account. The error that I get is:```
An error occurred (AccessDenied) when calling the CreateChangeSet operation: User: arn:aws:iam::<account_number_1>:user/amplify-elys is not authorized to perform: cloudformation:CreateChangeSet on resource: arn:aws:cloudformation:us-west-1:<account_number_1>:stack/aws-sam-cli-managed-default/* because no identity-based policy allows the cloudformation:CreateChangeSet action

I changed the profile using the AWS Toolkit to the second account, and verified that the aws_access_key_id and the aws_secret_access_key are correct.

Is there a SAM configuration file that needs to be changed? Why is the SAM CLI picking up a user from account_number_1?

[mndeveci]

I changed the profile using the AWS Toolkit

I am not sure if AWS Toolkit provides an alternative way for setting credentials. SAM CLI uses default way to use credentials (either through ~/.aws/credentials file or via environment variables). You could either;

• Change the default credentials under ~/.aws/credentials file or via setting environment variables which is defined here https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html#envvars-set
• If you need to switch back and forth between 2 accounts, you can create different profiles in ~/.aws/credentials file. And while running SAM CLI commands, you can provide profiles with --profile {profile-name}. With this setup, you can just run deploy commands with sam deploy --profile profile-for-account-1 and sam deploy --profile profile-for-account-2. Each command will use that specific profile definition. You can read more about setting profile definitions here: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html

[desert-digital]

This worked! Thanks so much. I was unaware of the profile flag. It appears that the AWS Toolkit modifies the ~/.aws/credentials file, but then doesn't use the flag!?!

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.