CloudTrail shows the access denies, but the missing service-linked role auto-creation was never logged in the regional trail you checked

The permissions symptom is real, yet the causal event lives in a different audit scope than the one the team has been searching.