aws iam_error ai_generated true

An error occurred (AccessDenied) when calling the AssumeRole operation

ID: aws/assume-role-unauthorized

Also available as: JSON · Markdown
88%Fix Rate
90%Confidence
50Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
2 active — — —

Root Cause

Can't assume the IAM role. Trust policy doesn't allow the caller, or caller lacks sts:AssumeRole.

generic

Workarounds

  1. 92% success Check the role's trust policy allows your principal (user/role ARN) 
    aws iam get-role --role-name <name> --query 'Role.AssumeRolePolicyDocument'

    Sources: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-api.html

  2. 90% success Ensure caller has sts:AssumeRole permission for the target role ARN 
    AssumeRole permission for the target role ARN

    Sources: https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html

  3. 82% success Check for ExternalId requirement if assuming cross-account role 
    Check for ExternalId requirement if assuming cross-account role

    Sources: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html

Dead Ends

Common approaches that don't work:

  1. Use root credentials instead 90% fail

    Root account should never be used for programmatic access

  2. Disable STS in the account 95% fail

    STS is required for role assumption — can't disable it

Error Chain

Leads to:
Preceded by: