Why adding '--create-db' to sql-sync command throws the access denied? The following command works without a problem:

drush sql-sync @alias1 @alias2


If I add "--create-db" I get:

ERROR 1044 (42000) at line 1: Access denied for user


Why might I be getting this error and what might I need to change? Do I need to add additional details to my alias file?

Also, is it correct that this is the best way to make sure that there aren't tables left over in @alias2 that have been removed from @alias1?
Try:

drush sql-sync @alias1 @alias2 --create-db --db-su=adminuser --db-su-pw=password


Substitute the appropriate username and password for your mysql admin user.  Note that if @alias2 is a remote alias on a shared server, it is possible that other users on that same server might be able to observe your mysql credentials if you use this command.  You might therefore prefer to use drush @alias2 sql-drop prior to sql-sync as an alternative method to dump your sql tables.

Of course, most of the time the remote alias will be the production db, and typically you will only sql-sync from production to dev, not the other way around, so the credentials leak is not usually a problem.