# Error: Invalid principal in policy: 'AWS: arn:aws:iam::123456789012:role/NonExistentRole'

- **ID:** `policy/aws-iam-role-trust-policy-invalid-principal`
- **Domain:** policy
- **Category:** config_error
- **Error Code:** `MalformedPolicyDocument`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

IAM role trust policy references a principal (e.g., another role or account) that does not exist or is misspelled, causing the policy to be rejected.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| AWS IAM API 2010-05-08 | active | — | — |
| aws-cli 2.14.0 | active | — | — |

## Workarounds

1. **Verify the ARN exists by running: aws iam get-role --role-name NonExistentRole. If it doesn't exist, create the role or correct the ARN. Example: change ARN to arn:aws:iam::123456789012:role/ExistingRole.** (95% success)
   ```
   Verify the ARN exists by running: aws iam get-role --role-name NonExistentRole. If it doesn't exist, create the role or correct the ARN. Example: change ARN to arn:aws:iam::123456789012:role/ExistingRole.
   ```
2. **Use a wildcard principal like 'AWS: *' if the trust policy should allow any role in the account, but this is risky for security.** (70% success)
   ```
   Use a wildcard principal like 'AWS: *' if the trust policy should allow any role in the account, but this is risky for security.
   ```

## Dead Ends

- **Use the role ID instead of ARN in the principal** — IAM policies require ARN format for principals; role IDs are not accepted in principal elements. (100% fail)
- **Add the principal as a service (e.g., 'Service: ec2.amazonaws.com') even if it's a role** — Service principals are for AWS services, not IAM roles; mixing types causes validation errors. (90% fail)