A company has an AWS CloudFormation template that creates an Amazon S3 bucket.

To create a CloudFormation stack, the user must have permission to call cloudformation:CreateStack. In addition, CloudFormation uses the caller’s permissions unless a service role is provided. Because the template creates an S3 bucket, the deployment also requires permission for s3:CreateBucket. If either permission is missing, stack creation can fail. cloudformation:CreateStackSet is not required because the question is about creating a normal stack, not deploying StackSets across accounts or Regions. s3:ListBucket and s3:PutObject are not the direct required permissions for creating the bucket resource in this scenario. AWS CloudFormation creates and configures resources based on permissions available to the caller or the assigned service role, so missing stack-creation or resource-creation permissions are valid causes of failure.

===============