VictoriaMetrics/VictoriaMetrics · error

cannot assume chained role=%q for roleARN=%q: %w

Error message

cannot assume chained role=%q for roleARN=%q: %w

What it means

Fires in getRoleWebIdentityCredentials when the chained role assumption (via assume-role in the web-identity flow, e.g. EKS IRSA with role chaining) fails for the given roleARN. The wrapped STS error explains why; inputs at fault are the chained role ARN and the target irsaRoleARN.

Source

Thrown at lib/awsapi/config.go:515

// aws IRSA for kubernetes.
// https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
func (cfg *Config) getRoleWebIdentityCredentials(token, roleARN string) (*credentials, error) {
	data, err := cfg.getSTSAPIResponse("AssumeRoleWithWebIdentity", roleARN, func(apiURL string) (*http.Request, error) {
		apiURL += fmt.Sprintf("&WebIdentityToken=%s", url.QueryEscape(token))
		return http.NewRequest(http.MethodGet, apiURL, nil)
	})
	if err != nil {
		return nil, err
	}
	creds, err := parseARNCredentials(data, "AssumeRoleWithWebIdentity")
	if err != nil {
		return nil, err
	}
	if len(cfg.roleARN) > 0 {
		// need to assume a different role
		assumeCreds, err := cfg.getRoleARNCredentials(creds, cfg.roleARN)
		if err != nil {
			return nil, fmt.Errorf("cannot assume chained role=%q for roleARN=%q: %w", cfg.roleARN, roleARN, err)
		}
		if assumeCreds.Expiration.After(creds.Expiration) {
			assumeCreds.Expiration = creds.Expiration
		}
		return assumeCreds, nil
	}
	return creds, nil
}

// getSTSAPIResponse makes request to aws sts api with the given cfg and returns temporary credentials with expiration time.
//
// See https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
func (cfg *Config) getSTSAPIResponse(action string, roleARN string, reqBuilder func(apiURL string) (*http.Request, error)) ([]byte, error) {
	// See https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Query-Requests.html
	apiURL := fmt.Sprintf("%s?Action=%s", cfg.stsEndpoint, action)
	apiURL += "&Version=2011-06-15"
	apiURL += fmt.Sprintf("&RoleArn=%s", roleARN)
	// we have to provide unique session name for cloudtrail audit

View on GitHub (pinned to 5079fb58f1)

Solutions

1. Verify the chained role's trust policy allows the IRSA role to assume it
2. Check session policy/permission boundaries do not deny sts:AssumeRole
3. Confirm role chaining depth is within AWS limits (up to 5 chained roles using credentials from AssumeRole)

When it happens

Trigger: Thrown at lib/awsapi/config.go:515 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/3593ec703acac709. Report an issue: GitHub.