anomalyco/sst · warning

The IAM role "%s" cannot be found in your AWS account. This

Error message

The IAM role "%s" cannot be found in your AWS account. This role should exist in every AWS account and is used by AWS RDS to create the RDS Proxy. However if you are using RDS for the first time, this role might not be created yet. Wait for a few minutes and try again.

What it means

This error is thrown by RdsRoleLookup.handle after polling AWS IAM GetRole for the RDS Proxy service-linked role for 5 minutes without the role ever appearing. The library treats the absence of this role as a transient AWS-side condition (AWS creates it lazily the first time RDS/RDS Proxy is used in an account), so it retries before failing. It only fires when the underlying error is types.NoSuchEntityException and the retry window is exhausted; any other IAM error is returned immediately.

Source

Thrown at pkg/server/resource/aws-rds-role-lookup.go:75

	for {
		_, err := client.GetRole(r.context, &iam.GetRoleInput{
			RoleName: aws.String(input.Name),
		})

		if err == nil {
			fmt.Println("found role", input.Name)
			return nil
		}

		// if error is not a NoSuchEntityException, return error
		var noSuchEntityErr *types.NoSuchEntityException
		if !errors.As(err, &noSuchEntityErr) {
			return err
		}

		if time.Since(start) > timeout {
			return fmt.Errorf("The IAM role \"%s\" cannot be found in your AWS account. This role should exist in every AWS account and is used by AWS RDS to create the RDS Proxy. However if you are using RDS for the first time, this role might not be created yet. Wait for a few minutes and try again.", input.Name)
		}

		time.Sleep(5 * time.Second)
	}
}

View on GitHub (pinned to a0bd20f762)

Solutions

1. Wait 10-15 minutes and redeploy — AWS creates the service-linked role automatically once RDS is first activated in the account
2. Trigger creation of the role manually: aws iam create-service-linked-role --aws-service-name rds.amazonaws.com
3. Verify the role exists with: aws iam get-role --role-name AWSServiceRoleForRDS
4. Check the account/credentials being used actually target the expected AWS account and region
5. If a custom role name was passed, confirm it matches the real role name in IAM

Example fix

// before (shell, failing deploy)
go run ../../cmd/sst deploy
// after — pre-create the service-linked role, then redeploy
aws iam create-service-linked-role --aws-service-name rds.amazonaws.com
go run ../../cmd/sst deploy

aws iam get-role --role-name AWSServiceRoleForRDS
# or in Go before deploying:
_, err := iamClient.GetRole(ctx, &iam.GetRoleInput{RoleName: aws.String("AWSServiceRoleForRDS")})

err := rdsRoleLookup.Create(input, &out)
if err != nil && strings.Contains(err.Error(), "cannot be found in your AWS account") {
    // account is new to RDS; schedule a retry after a delay
    time.Sleep(10 * time.Minute)
    err = rdsRoleLookup.Create(input, &out)
}

When it happens

Trigger: Calling Create/Update on an sst RDS resource whose deployment needs the rds.amazonaws.com service-linked role in an AWS account that has never used RDS or RDS Proxy; the role does not exist and is still missing after 5 minutes of 5-second polling of GetRole.

Common situations: Brand-new AWS accounts or newly created member accounts in an organization using RDS for the first time; a typo'd/custom role name passed as input.Name that is not the service-linked role; IAM eventual-consistency delays longer than 5 minutes after first RDS activation; the service-linked role having been manually deleted.

Related errors

• Storage must be at least 20 GB for the ${name} MySQL databas
• Storage cannot be greater than 65536 GB (64 TB) for the ${na
• Bastion instance profile must be a name, not an ARN.
• Failed to publish event to bus
• Failed to describe task

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/d101639c09751242. Report an issue: GitHub.