Why adding '--create-db' to sql-sync command throws the access denied?
Try:

drush sql-sync @alias1 @alias2 --create-db --db-su=adminuser --db-su-pw=password


Substitute the appropriate username and password for your mysql admin user.  Note that if @alias2 is a remote alias on a shared server, it is possible that other users on that same server might be able to observe your mysql credentials if you use this command.  You might therefore prefer to use drush @alias2 sql-drop prior to sql-sync as an alternative method to dump your sql tables.

Of course, most of the time the remote alias will be the production db, and typically you will only sql-sync from production to dev, not the other way around, so the credentials leak is not usually a problem.