FlowiseAI/Flowise · error · Error

Invalid Role ARN format: Expected format: arn:aws:iam::<12-d

Error message

Invalid Role ARN format: Expected format: arn:aws:iam::<12-digit-account-id>:role/<role-name>

What it means

getAWSCredentialConfig() validates roleArn against AWS_ROLE_ARN_REGEX `/^arn:aws(-[a-z]+(-[a-z]+)?)?:iam::\d{12}:role\/[\w+=,.@/-]+$/` before calling STS. The regex requires the literal `role/` resource prefix, exactly 12 digits for the account id, and supports the aws / aws-cn / aws-us-gov partitions.

Source

Thrown at packages/components/src/awsToolsUtils.ts:89

 * @returns {Promise<AWSCredentialConfig>} Resolved credential configuration with optional
 *   `credentials` and `region` fields
 * @throws {Error} If STS AssumeRole fails (e.g., access denied, invalid Role ARN, wrong
 *   External ID) — The full error is logged server-side.
 */
export async function getAWSCredentialConfig(nodeData: INodeData, options: ICommonObject, region?: string): Promise<AWSCredentialConfig> {
    const credentialData = await getCredentialData(nodeData.credential ?? '', options)
    const awsRegion = region || DEFAULT_AWS_REGION

    const accessKeyId = getCredentialParam('awsKey', credentialData, nodeData)
    const secretAccessKey = getCredentialParam('awsSecret', credentialData, nodeData)
    const sessionToken = getCredentialParam('awsSession', credentialData, nodeData)
    const roleArn = getCredentialParam('roleArn', credentialData, nodeData)
    const externalId = getCredentialParam('externalId', credentialData, nodeData)

    // --- AssumeRole flow ---
    if (roleArn) {
        if (!AWS_ROLE_ARN_REGEX.test(roleArn)) {
            throw new Error('Invalid Role ARN format: Expected format: arn:aws:iam::<12-digit-account-id>:role/<role-name>')
        }
        const assumedCredentials = await assumeRole({
            accessKeyId,
            secretAccessKey,
            sessionToken,
            roleArn,
            externalId,
            region: awsRegion,
            logger: options.logger
        })
        return { credentials: assumedCredentials, region: awsRegion }
    }

    // --- Static credentials flow (backward-compatible) ---
    if (accessKeyId && secretAccessKey) {
        const credentials: AWSCredentials = {
            accessKeyId,
            secretAccessKey,

View on GitHub (pinned to abe4a8601a)

Solutions

1. Use the exact ARN from IAM Console -> Roles -> (role) -> Copy ARN. Format: `arn:aws:iam::123456789012:role/my-role`.
2. Ensure the account id is exactly 12 digits.
3. For aws-cn / aws-us-gov partitions use `arn:aws-cn:iam::...` / `arn:aws-us-gov:iam::...`.
4. Trim surrounding whitespace and remove wrapping quotes.
5. Confirm you copied a role ARN (resource starts with `role/`), not a user, policy, or instance-profile ARN.

Example fix

// before
roleArn = 'arn:aws:iam::12345678901:role/my-role'   // 11 digits
roleArn = 'arn:aws:iam::123456789012:user/svc'        // wrong resource type

// after
roleArn = 'arn:aws:iam::123456789012:role/my-role'   // 12 digits, role/

// Validate the Role ARN format before passing it to getAWSCredentialConfig
const AWS_ROLE_ARN_REGEX = /^arn:aws(-[a-z]+(-[a-z]+)?)?:iam::\d{12}:role\/[\w+=,.@/-]+$/
function assertRoleArn(arn) {
    if (!AWS_ROLE_ARN_REGEX.test(arn.trim())) {
        throw new Error('Role ARN must be arn:<partition>:iam::<12-digit-id>:role/<name>')
    }
}

function isValidRoleArn(arn) {
    return typeof arn === 'string' && /^arn:aws(-[a-z]+(-[a-z]+)?)?:iam::\d{12}:role\/[\w+=,.@/-]+$/.test(arn.trim())
}

try {
    const cfg = await getAWSCredentialConfig(nodeData, options, region)
} catch (e) {
    if (/Invalid Role ARN format/.test(e.message)) {
        // ask the user to paste a fresh arn:aws:iam::<id>:role/<name> from the IAM console
    }
    throw e
}

When it happens

Trigger: roleArn credential param is malformed: missing the `role/` prefix (e.g. a user or policy ARN like `arn:aws:iam::123456789012:user/foo`), account id not exactly 12 digits, wrong partition, leading/trailing whitespace, copy-paste truncated the ARN, or a stray trailing slash only path mismatch.

Common situations: Copied the role ARN from the AWS console but truncated it; used a user/policy ARN by mistake; non-12-digit account id; China (aws-cn) or GovCloud (aws-us-gov) partition omitted; pasted with surrounding quotes or whitespace.

Related errors

• Valid DynamoDB Table selection is required
• Key prefix cannot contain "${KEY_SEPARATOR}" character
• SNS Topic ARN is required
• STS AssumeRole returned incomplete credentials
• Failed to assume IAM role. Verify that the Role ARN is corre

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/efbbcb95e5fa07c0. Report an issue: GitHub.