← Back to all fixes
AWS

AWS assume role fails with AccessDenied

The Issue

`aws sts assume-role --role-arn arn:aws:iam::123:role/MyRole` returns AccessDenied.

Root Cause

The IAM entity calling AssumeRole is not listed in the role's trust policy, or the entity's permission policy does not include `sts:AssumeRole`.

How to Fix
  1. Check the target role's Trust Policy — the calling account/user/service must be in `Principal`
  2. Check the caller's IAM policy includes `sts:AssumeRole` for the target role ARN
  3. If cross-account: both the trust policy (in target account) and the permission policy (in source account) must be set
  4. Verify you are using the correct role ARN (exact match, no typos)
  5. Use CloudTrail to see the exact denied API call and which policy blocked it
← More fixes