AWS STS AssumeRole Access Denied: Trust Policy vs Permissions
Understand AssumeRole failures by separating role trust relationships, caller permissions, session conditions, and organization guardrails.
An STS AssumeRole failure often confuses two distinct questions: is the caller allowed to request the role, and does the target role trust that caller? Both sides must be evaluated, along with conditions and organization controls.
Identify the caller and target role
Capture the caller’s account and principal type, the target role ARN, and the exact STS error. Confirm that the role exists in the expected account and that the request uses the intended external ID, session name, and other required parameters.
Review the caller’s permission to assume the role
The caller commonly needs an identity-based policy allowing sts:AssumeRole on the target role ARN. Check conditions and any explicit denies or organizational restrictions.
Review the target role trust policy
The target role’s trust policy controls which principals may assume it. Confirm that the principal and any condition keys match the intended identity and request context. Cross-account setups require particular attention to both accounts’ configuration.
Check MFA, external ID, and session constraints
A trust policy may require MFA, an external ID, source identity, or other conditions. The request must satisfy them. Do not remove a security condition simply because a request fails; verify the intended trust model with the role owner.
Retest and audit
Use the approved identity and exact role to repeat the request, then review relevant CloudTrail records. Document whether the failure was caller authorization, trust, or another guardrail.
Frequently asked questions
Does the target role’s trust policy grant all permissions?
No. Trust determines who can assume the role; permissions attached to the role govern what the resulting session can do.
Can I fix AssumeRole by adding AdministratorAccess to the caller?
Not necessarily. A trust-policy mismatch or explicit deny can still block the request, and broad access is not a sound default fix.
Official documentation and further reading
Make AWS error investigations easier
SameWindow AWS Assistant is designed to help organize supported visible AWS Console errors into a clearer investigation workflow. It does not replace AWS documentation, service logs, security review, or administrator approval. Review the product details and setup status before installing.
Explore SameWindow AWS AssistantSetup instructions