I am not an expert for this topic - nevertheless I manged it somehow a few months ago.
As far as I remember the permission model on AWS changed in the meantime ( time between OH2.5 came out and time OH3.3 came out ).
So as far as I remember I needed to do adaptions in AWS IAM.
The comment reference I provided in my response includes links to the permission policy necessary for the ASK-CLI deployment and how to set it up in the AWS IAM console. Other than that I would recommend looking for tutorials on how to manage AWS permissions with their IAM service if you are not familiar with how to do so.