{"record":{"id":"a58b6904981b890e","repo":"FlowiseAI/Flowise","slug":"failed-to-assume-iam-role-verify-that-the-role-ar","errorCode":null,"errorMessage":"Failed to assume IAM role. Verify that the Role ARN is correct, the trust policy allows assumption from these credentials, and the External ID matches (if required). Check server logs for details.","messagePattern":"Failed to assume IAM role\\. Verify that the Role ARN is correct, the trust policy allows assumption from these credentials, and the External ID matches \\(if required\\)\\. Check server logs for details\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/awsToolsUtils.ts","lineNumber":197,"sourceCode":"            throw new Error('STS AssumeRole returned incomplete credentials')\n        }\n\n        return {\n            accessKeyId: response.Credentials.AccessKeyId,\n            secretAccessKey: response.Credentials.SecretAccessKey,\n            sessionToken: response.Credentials.SessionToken\n        }\n    } catch (error) {\n        if (error instanceof Error && error.message === 'STS AssumeRole returned incomplete credentials') {\n            throw error\n        }\n        const rawMessage = error instanceof Error ? error.message : String(error)\n        // Log full error server-side for operator debugging (includes IAM principal ARNs, account IDs, etc.)\n        if (logger) {\n            logger.error(`[AWS STS] AssumeRole failed for role \"${roleArn}\": ${rawMessage}`)\n        }\n        // Return sanitized error to user — no raw STS message that may contain internal infrastructure details\n        throw new Error(\n            'Failed to assume IAM role. ' +\n                'Verify that the Role ARN is correct, the trust policy allows assumption from these credentials, ' +\n                'and the External ID matches (if required). Check server logs for details.'\n        )\n    }\n}\n\n/**\n * Get AWS credentials from node data (backward-compatible wrapper).\n *\n * This function preserves the original API used by **Pattern A** nodes (AWS SNS,\n * DynamoDB KV Storage). Internally it delegates to {@link getAWSCredentialConfig}\n * and unwraps the credentials.\n *\n * **Behavior**:\n * - When `roleArn` is configured: returns temporary credentials from STS AssumeRole\n * - When static keys (`awsKey` + `awsSecret`) are provided: returns them directly\n * - When neither keys nor `roleArn` are provided: returns `undefined`, allowing the","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/awsToolsUtils.ts#L179-L215","documentation":"Sanitized wrapper thrown by the catch in assumeRole() for ANY STS error other than the incomplete-credentials case (571). The raw STS message — which can include IAM principal ARNs, account IDs, error codes — is logged server-side via logger.error(\"[AWS STS] AssumeRole failed for role ...\") but is deliberately NOT surfaced to the user. Users see generic guidance pointing at trust policy, External ID, and Role ARN correctness.","triggerScenarios":"STS rejects AssumeRole: AccessDenied (trust policy doesn't grant sts:AssumeRole to the calling principal), ExpiredToken or InvalidClientTokenId (base creds bad), wrong ExternalId (AccessDenied with a conditional check), role in a different partition, throttling, explicit Deny in an SCP.","commonSituations":"Role trust policy doesn't list the calling principal (root/user/role) as Principal or lacks sts:AssumeRole; ExternalId mismatch with the trust policy condition; base awsKey/awsSecret rotated or revoked; cross-account trust not yet established; SCP or permissions boundary blocking the assume.","solutions":["Check the server logs for the `[AWS STS] AssumeRole failed for role \"<roleArn>\"` line — it carries the raw STS error code (AccessDenied, ExpiredToken, etc.).","Verify the role's trust policy permits the calling principal to perform sts:AssumeRole.","Verify the ExternalId in the credential matches the trust policy's sts:ExternalId condition exactly.","Verify the base credentials (awsKey/awsSecret) are still valid and were not rotated.","Confirm the Role ARN account id and partition match the role you intend to assume.","Check for SCPs / permissions boundaries that might explicitly Deny the assume."],"exampleFix":"// trust policy must allow the caller, e.g.\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Effect\": \"Allow\",\n    \"Principal\": { \"AWS\": \"arn:aws:iam::111111111111:root\" },\n    \"Action\": \"sts:AssumeRole\",\n    \"Condition\": { \"StringEquals\": { \"sts:ExternalId\": \"my-external-id\" } }\n  }]\n}","handlingStrategy":"try-catch","validationCode":"// Pre-flight trust policy checklist (operator-side)\nfunction preflightAssumeRole(roleArn, externalId, baseCreds) {\n    if (!isValidRoleArn(roleArn)) throw new Error('Invalid role ARN')\n    if (!baseCreds?.accessKeyId || !baseCreds?.secretAccessKey) throw new Error('Base credentials missing')\n    // externalId is optional but if set, must match the role trust policy condition\n}","typeGuard":"null","tryCatchPattern":"try {\n    const cfg = await getAWSCredentialConfig(nodeData, options, region)\n} catch (e) {\n    if (/Failed to assume IAM role/.test(e.message)) {\n        // this is sanitized; read server logs for the [AWS STS] line with the real code\n        options.logger?.error('Assume role guidance shown to user; see server logs for raw STS error')\n    }\n    throw e\n}","preventionTips":["Configure the role trust policy to allow the calling principal with sts:AssumeRole.","Set the ExternalId condition in the trust policy and supply the matching value in the credential.","Rotate and verify base credentials (awsKey/awsSecret) regularly.","Surface the sanitized message to users but always log the raw STS error server-side."],"tags":["aws","sts","assume-role","access-denied","trust-policy","external-id"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}