Serverless Framework "serverless deploy" Fails in CI

The Serverless Framework synthesized a CloudFormation stack and the deploy failed - a resource error, an IAM gap, or invalid AWS credentials. Like SAM, the framework wraps CloudFormation, so the real reason is in the stack events.

What this error means

serverless deploy fails after packaging, reporting a CloudFormation error or invalid credentials. A resource/IAM failure reproduces every run; a credential or throttling issue may need the credentials fixed or the deploy retried.

serverless output

Error:
CREATE_FAILED: HelloLambdaFunction (AWS::Lambda::Function)
Resource handler returned message: "User is not authorized to perform:
iam:CreateRole" (Service: Lambda, Status Code: 403)

Common causes

A resource or IAM failure in the stack

CloudFormation rolled back because a resource could not be created - most often the deploy role lacks an IAM permission the generated stack needs (creating roles, log groups, the deployment bucket).

Invalid or missing AWS credentials

No credentials on the runner, an expired token, or a wrong profile makes the deploy fail before or during the CloudFormation call.

How to fix it

Read the failing CloudFormation resource

Deploy verbosely and inspect the stack events to find the first resource that failed.

Terminal

serverless deploy --verbose --stage prod
# then inspect the stack events for the first CREATE_FAILED

Wire credentials and grant deploy permissions

Configure AWS credentials in the same job (OIDC role preferred) and verify with aws sts get-caller-identity.
Grant the deploy role the IAM permissions the generated stack needs (roles, log groups, S3 deployment bucket).
Pin the Serverless Framework version so generated templates are stable across runs.

How to prevent it

Use an OIDC deploy role scoped to the actions the stack requires.
Run serverless package in PR checks to catch template errors before deploy.
Pin the framework and plugin versions in CI.