STS Decode
When failing a command it will give you an encoded error message. For example when we were testing it with Dryrun.
We can then decode the message using
aws sts decode-authorization-message --encoded-message long_encoded_message
The result will return us a json file that describe the information of why the command is failed.