{"record":{"id":"3593ec703acac709","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-assume-chained-role-q-for-rolearn-q-w","errorCode":null,"errorMessage":"cannot assume chained role=%q for roleARN=%q: %w","messagePattern":"cannot assume chained role=%q for roleARN=%q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/awsapi/config.go","lineNumber":515,"sourceCode":"// aws IRSA for kubernetes.\n// https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/\nfunc (cfg *Config) getRoleWebIdentityCredentials(token, roleARN string) (*credentials, error) {\n\tdata, err := cfg.getSTSAPIResponse(\"AssumeRoleWithWebIdentity\", roleARN, func(apiURL string) (*http.Request, error) {\n\t\tapiURL += fmt.Sprintf(\"&WebIdentityToken=%s\", url.QueryEscape(token))\n\t\treturn http.NewRequest(http.MethodGet, apiURL, nil)\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tcreds, err := parseARNCredentials(data, \"AssumeRoleWithWebIdentity\")\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif len(cfg.roleARN) > 0 {\n\t\t// need to assume a different role\n\t\tassumeCreds, err := cfg.getRoleARNCredentials(creds, cfg.roleARN)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"cannot assume chained role=%q for roleARN=%q: %w\", cfg.roleARN, roleARN, err)\n\t\t}\n\t\tif assumeCreds.Expiration.After(creds.Expiration) {\n\t\t\tassumeCreds.Expiration = creds.Expiration\n\t\t}\n\t\treturn assumeCreds, nil\n\t}\n\treturn creds, nil\n}\n\n// getSTSAPIResponse makes request to aws sts api with the given cfg and returns temporary credentials with expiration time.\n//\n// See https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html\nfunc (cfg *Config) getSTSAPIResponse(action string, roleARN string, reqBuilder func(apiURL string) (*http.Request, error)) ([]byte, error) {\n\t// See https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Query-Requests.html\n\tapiURL := fmt.Sprintf(\"%s?Action=%s\", cfg.stsEndpoint, action)\n\tapiURL += \"&Version=2011-06-15\"\n\tapiURL += fmt.Sprintf(\"&RoleArn=%s\", roleARN)\n\t// we have to provide unique session name for cloudtrail audit","sourceCodeStart":497,"sourceCodeEnd":533,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/awsapi/config.go#L497-L533","documentation":"Fires in getRoleWebIdentityCredentials when the chained role assumption (via assume-role in the web-identity flow, e.g. EKS IRSA with role chaining) fails for the given roleARN. The wrapped STS error explains why; inputs at fault are the chained role ARN and the target irsaRoleARN.","triggerScenarios":"Thrown at lib/awsapi/config.go:515 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the chained role's trust policy allows the IRSA role to assume it","Check session policy/permission boundaries do not deny sts:AssumeRole","Confirm role chaining depth is within AWS limits (up to 5 chained roles using credentials from AssumeRole)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}