AWS Robomaker error: (AccessDeniedException) User: arn:aws:iam... is not authorized to perform: robomaker:CreateSimulationJob

Question

meta.stackexchange.com#141944 suggests that a question of "AWS + personal usage" like mine can be asked here so hope I'm on the right site.

Following a tutorial of AWS Robomaker (aws.amazon.com), in "Create and run robot and simulation applications with containers in AWS RoboMaker" section step 6, running the following command fails with the error (creds replaced).

What am I missing/wrong? I basically created this AWS account afresh, so not so many configuration has been done.

$ aws robomaker create-simulation-job --cli-input-json file://create_simulation_job.json

An error occurred (AccessDeniedException) when calling the CreateSimulationJob operation: User: arn:aws:iam::292945459999:user/fname.lname is not authorized to perform: robomaker:CreateSimulationJob on resource: arn:aws:robomaker:us-east-1:292945459999:simulation-application/robomaker-helloworld-sim-app/1675482941456

Content of create_simulation_job.json

(As it's unclear in the tutorial, I made a guess to take ARN of "application" from robomaker-helloworld-sim-app simulation app on Robomaker)

    "maxJobDurationInSeconds": 3600,
    "iamRole": "arn:aws:iam::292945459999:role/RoboMaker-HelloWorld-Role",
    "robotApplications": [
        {
            "application": "arn:aws:robomaker:us-east-1:292945459999:simulation-application/robomaker-helloworld-sim-app/1675482941456",
            "applicationVersion": "$LATEST",
            "launchConfig": {
                "environmentVariables": {
                    "ROS_IP": "ROBOMAKER_ROBOT_APP_IP",
                    "ROS_MASTER_URI": "http://ROBOMAKER_ROBOT_APP_IP:11311",
                    "GAZEBO_MASTER_URI": "http://ROBOMAKER_SIM_APP_IP:11345"
                },
                "streamUI": false,
                "command": [
                    "roslaunch", "hello_world_robot", "rotate.launch"
                ]
            },
            "tools": [
                {
                    "streamUI": true,
                    "name": "robot-terminal",
                    "command": "/entrypoint.sh && xfce4-terminal",
                    "streamOutputToCloudWatch": true,
                    "exitBehavior": "RESTART"
                }
            ]
        }
    ],
    "simulationApplications": [
        {
            "application": "arn:aws:robomaker:us-east-1:292945459999:simulation-application/robomaker-helloworld-sim-app/1675482941456",
            "launchConfig": {
                "environmentVariables": {
                  "ROS_IP": "ROBOMAKER_SIM_APP_IP",
                  "ROS_MASTER_URI": "http://ROBOMAKER_ROBOT_APP_IP:11311",
                  "GAZEBO_MASTER_URI": "http://ROBOMAKER_SIM_APP_IP:11345",
                  "TURTLEBOT3_MODEL":"waffle_pi"
                },
                "streamUI": true,
                "command": [
                    "roslaunch", "hello_world_simulation", "empty_world.launch"
                ]
            },
            "tools": [
                {
                    "streamUI": true,
                    "name": "gzclient",
                    "command": "/entrypoint.sh && gzclient",
                    "streamOutputToCloudWatch": true,
                    "exitBehavior": "RESTART"
                }
            ]
        }
    ]
}

The IAM user has the following permissions: AdministratorAccess, AWSDeepRacerRoboMakerAccessPolicy, AWSRoboMaker_FullAccess

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.5 LTS
Release:        20.04
Codename:       focal

$ aws --version
aws-cli/1.27.64 Python/3.8.10 Linux/5.4.0-137-generic botocore/1.29.64

Answer 1

Resolved myself.

I think I forgot to run aws robomaker create-robot-application command in the tutorial (aws.amazon.com), as I didn't see robot app on my "Robomaker -> Development -> Robot Applications". So I first (re-)ran:

aws robomaker create-robot-application \
--name $robotapp \
--robot-software-suite name=General \
--environment uri=$ecruri/$robotapp:latest

Then replacing ARN in create_simulation_job.json file with the one the create-robot-application just returned, ran aws robomaker create-simulation-job command and the it passed this time, I see a simulation job on "Robomaker -> Simulation run -> Simulation jobs" as expected.

In create_simulation_job.json in the OP, there's one thing clearly wrong: I was passing ARN of "sim app" where that of "robot app" was expected (although the error message didn't make that clear)..

    "robotApplications": [
        {
            "application": "arn:aws:robomaker:us-east-1:292945459999:simulation-application/robomaker-helloworld-sim-app/1675482941456",
    :