Ensure a support role has been created to manage incidents with AWS Support

How to fix it

Attach the AWS managed policy AWSSupportAccess to a role, user or group so that someone can open support cases during an incident. The attachment is what passes, not the name: a role called anything at all qualifies once it carries the policy. A group counts only while it has at least one member. The Support API needs a Business, Enterprise On-Ramp or Enterprise support plan, so on a lower plan the permission is right but cases still have to be raised through the console.

In the console

IAM → Roles → the incident response role → Permissions policies

With the AWS CLI

aws iam attach-role-policy --role-name <role-name> --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess

With Terraform

resource "aws_iam_role_policy_attachment" "this" {
  role       = var.role_name
  policy_arn = "arn:aws:iam::aws:policy/AWSSupportAccess"
}