Terraform "Error: creating ..." - Diagnose Provider API Failures

Error: creating ... is the provider reporting that the cloud API rejected a create call. The real cause is always in the suffix - permissions, a quota, a validation rule, or a conflict.

What this error means

terraform apply fails on a specific resource with Error: creating <type> (<name>): <API error>. The wrapper is generic; the API message after it is the actual problem to act on.

terraform apply output

Error: creating EC2 Instance: operation error EC2: RunInstances,
api error UnauthorizedOperation: You are not authorized to perform this
operation.

  with aws_instance.app,
  on main.tf line 20, in resource "aws_instance" "app":

Common causes

Insufficient IAM/API permissions

The credentials can authenticate but lack the specific action (e.g. ec2:RunInstances). The API returns Unauthorized/AccessDenied for that create.

Validation, quota, or conflict from the API

An invalid argument, a hit service quota/limit, or a name/identifier conflict makes the provider API reject the create deterministically.

How to fix it

Read the API suffix and act on it

Look at the message after Error: creating ... - that is the real cause.
For Unauthorized/AccessDenied, add the missing IAM action to the CI role.
For quota errors, request a limit increase or reduce what you create.
For validation/conflict errors, fix the offending argument or rename the resource.

Re-run with detailed logs

Enable trace logging to see the exact API request and response.

Terminal

TF_LOG=DEBUG terraform apply 2> tf-debug.log

How to prevent it

Grant the CI role exactly the API actions your resources need.
Track service quotas for resource-heavy applies.
Run terraform plan in PRs so create-time problems surface before apply.