AWS SAM deploy failing

Question

I have taken over some code where I don't have any context to how it was built initially, my only task is to "deploy to AWS". It is a SAM application using cloudformation, lambda, s3, cognito, and dynamoDb.

I have installed aws-cli and aws-sam-cli and configured IAM to the best of my ability, but am stuck on the following error when trying to deploy:

    Creating the required resources...
Error: Failed to create managed resources: Waiter ChangeSetCreateComplete failed: Waiter encountered a terminal failure state: For expression "Status" we matched expected path: "FAILED"

Of note, I get the same thing when going through the AWS sample hello-world SAM tutorial. https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-getting-started-hello-world.html

The tutorial doesn't mention making any modifications to their code, and this is the template.yml it comes with.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  test-app

  Sample SAM Template for test-app
  
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 3

Resources:
  HelloWorldFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: hello-world/
      Handler: app.lambdaHandler
      Runtime: nodejs14.x
      Events:
        HelloWorld:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /hello
            Method: get

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api
  HelloWorldApi:
    Description: "API Gateway endpoint URL for Prod stage for Hello World function"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/hello/"
  HelloWorldFunction:
    Description: "Hello World Lambda Function ARN"
    Value: !GetAtt HelloWorldFunction.Arn
  HelloWorldFunctionIamRole:
    Description: "Implicit IAM Role created for Hello World function"
    Value: !GetAtt HelloWorldFunctionRole.Arn

I've seen other similar errors posted online where the answer was the yaml was not formatted correctly, but I would assume the template.yml from AWS is correct. I guess my question is - what is going wrong and how do I figure that out? Is there a way to know if the IAM permissions aren't correct? I granted all access to lamdba, cloudformation, cognito user pool, api gateway, and iam:listPolicies (in addition to already existing permissions for dynamodb, s3)

I used sam validate and it return success, so I'm not sure what else to try. I did the sam build step before deploying and I ran the deploy command as deploy --guided and deploy --guided --capabilities CAPABILITY_IAM and deploy --guided --capabilities CAPABILITY_NAMED_IAM all with no luck.