FlowiseAI/Flowise · error · Error

STS AssumeRole returned incomplete credentials

Error message

STS AssumeRole returned incomplete credentials

What it means

After stsClient.send(AssumeRoleCommand) succeeds, the code requires response.Credentials to contain AccessKeyId, SecretAccessKey, AND SessionToken. If any of the three is missing/empty it throws. The AWS SDK normally returns all three on a successful AssumeRole, so this is an unusual partial-response condition, often from an emulator, a proxy mangling the XML, or an SDK deserialization mismatch.

Source

Thrown at packages/components/src/awsToolsUtils.ts:179

        }
    }

    const stsClient = new STSClient(stsConfig)

    const assumeRoleInput: AssumeRoleCommandInput = {
        RoleArn: roleArn,
        RoleSessionName: `FlowiseSession-${Date.now()}`
    }

    if (externalId) {
        assumeRoleInput.ExternalId = externalId
    }

    try {
        const response = await stsClient.send(new AssumeRoleCommand(assumeRoleInput))

        if (!response.Credentials?.AccessKeyId || !response.Credentials?.SecretAccessKey || !response.Credentials?.SessionToken) {
            throw new Error('STS AssumeRole returned incomplete credentials')
        }

        return {
            accessKeyId: response.Credentials.AccessKeyId,
            secretAccessKey: response.Credentials.SecretAccessKey,
            sessionToken: response.Credentials.SessionToken
        }
    } catch (error) {
        if (error instanceof Error && error.message === 'STS AssumeRole returned incomplete credentials') {
            throw error
        }
        const rawMessage = error instanceof Error ? error.message : String(error)
        // Log full error server-side for operator debugging (includes IAM principal ARNs, account IDs, etc.)
        if (logger) {
            logger.error(`[AWS STS] AssumeRole failed for role "${roleArn}": ${rawMessage}`)
        }
        // Return sanitized error to user — no raw STS message that may contain internal infrastructure details
        throw new Error(

View on GitHub (pinned to abe4a8601a)

Solutions

1. If using a mock/emulator, ensure it returns AccessKeyId, SecretAccessKey, and SessionToken in Credentials.
2. Retry once — transient partial responses are rare but possible.
3. Upgrade or pin @aws-sdk/client-sts to a known-good version.
4. Verify no proxy is altering the STS response body.
5. Confirm you are hitting real AWS STS (or a faithful emulator) for the partition.

Example fix

// before (mock returns partial)
{ Credentials: { AccessKeyId: 'ASIA...', SecretAccessKey: '...' } } // no SessionToken

// after (mock returns full)
{ Credentials: { AccessKeyId: 'ASIA...', SecretAccessKey: '...', SessionToken: 'IQo...' } }

// Validate the (mock) STS response shape during tests
function assertAssumeRoleResponse(resp) {
    const c = resp.Credentials
    if (!c?.AccessKeyId || !c?.SecretAccessKey || !c?.SessionToken) {
        throw new Error('STS mock must return AccessKeyId, SecretAccessKey, and SessionToken')
    }
}

function hasCompleteCredentials(resp) {
    const c = resp?.Credentials
    return Boolean(c?.AccessKeyId && c?.SecretAccessKey && c?.SessionToken)
}

// Retry once on the rare partial-response case
async function assumeRoleSafe(input) {
    try {
        return await assumeRole(input)
    } catch (e) {
        if (/incomplete credentials/i.test(e.message)) {
            return await assumeRole(input) // single retry
        }
        throw e
    }
}

When it happens

Trigger: STS-compatible mock/emulator (LocalStack, moto) returns a Credentials object missing a field; a proxy strips part of the response body; an SDK version mismatch deserializes incompletely; transient partial response from a non-AWS STS endpoint.

Common situations: Local testing against LocalStack/moto that returns partial credentials; transparent proxy modifying the STS XML/JSON response; pinning to an @aws-sdk/client-sts version with a known deserialization regression.

Related errors

• Failed to assume IAM role. Verify that the Role ARN is corre
• Invalid Role ARN format: Expected format: arn:aws:iam::<12-d
• Failed to retrieve secret value.
• Failed to decrypt credential data.
• OpenAI ApiKey not found

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/b172cf7b9d3f9c68. Report an issue: GitHub.