{"record":{"id":"d101639c09751242","repo":"anomalyco/sst","slug":"the-iam-role-s-cannot-be-found-in-your-aws-acco","errorCode":null,"errorMessage":"The IAM role \"%s\" cannot be found in your AWS account. This role should exist in every AWS account and is used by AWS RDS to create the RDS Proxy. However if you are using RDS for the first time, this role might not be created yet. Wait for a few minutes and try again.","messagePattern":"The IAM role \"(.+?)\" cannot be found in your AWS account\\. This role should exist in every AWS account and is used by AWS RDS to create the RDS Proxy\\. However if you are using RDS for the first time, this role might not be created yet\\. Wait for a few minutes and try again\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/server/resource/aws-rds-role-lookup.go","lineNumber":75,"sourceCode":"\n\tfor {\n\t\t_, err := client.GetRole(r.context, &iam.GetRoleInput{\n\t\t\tRoleName: aws.String(input.Name),\n\t\t})\n\n\t\tif err == nil {\n\t\t\tfmt.Println(\"found role\", input.Name)\n\t\t\treturn nil\n\t\t}\n\n\t\t// if error is not a NoSuchEntityException, return error\n\t\tvar noSuchEntityErr *types.NoSuchEntityException\n\t\tif !errors.As(err, &noSuchEntityErr) {\n\t\t\treturn err\n\t\t}\n\n\t\tif time.Since(start) > timeout {\n\t\t\treturn fmt.Errorf(\"The IAM role \\\"%s\\\" cannot be found in your AWS account. This role should exist in every AWS account and is used by AWS RDS to create the RDS Proxy. However if you are using RDS for the first time, this role might not be created yet. Wait for a few minutes and try again.\", input.Name)\n\t\t}\n\n\t\ttime.Sleep(5 * time.Second)\n\t}\n}\n\n","sourceCodeStart":57,"sourceCodeEnd":82,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/pkg/server/resource/aws-rds-role-lookup.go#L57-L82","documentation":"This error is thrown by RdsRoleLookup.handle after polling AWS IAM GetRole for the RDS Proxy service-linked role for 5 minutes without the role ever appearing. The library treats the absence of this role as a transient AWS-side condition (AWS creates it lazily the first time RDS/RDS Proxy is used in an account), so it retries before failing. It only fires when the underlying error is types.NoSuchEntityException and the retry window is exhausted; any other IAM error is returned immediately.","triggerScenarios":"Calling Create/Update on an sst RDS resource whose deployment needs the rds.amazonaws.com service-linked role in an AWS account that has never used RDS or RDS Proxy; the role does not exist and is still missing after 5 minutes of 5-second polling of GetRole.","commonSituations":"Brand-new AWS accounts or newly created member accounts in an organization using RDS for the first time; a typo'd/custom role name passed as input.Name that is not the service-linked role; IAM eventual-consistency delays longer than 5 minutes after first RDS activation; the service-linked role having been manually deleted.","solutions":["Wait 10-15 minutes and redeploy — AWS creates the service-linked role automatically once RDS is first activated in the account","Trigger creation of the role manually: aws iam create-service-linked-role --aws-service-name rds.amazonaws.com","Verify the role exists with: aws iam get-role --role-name AWSServiceRoleForRDS","Check the account/credentials being used actually target the expected AWS account and region","If a custom role name was passed, confirm it matches the real role name in IAM"],"exampleFix":"// before (shell, failing deploy)\ngo run ../../cmd/sst deploy\n// after — pre-create the service-linked role, then redeploy\naws iam create-service-linked-role --aws-service-name rds.amazonaws.com\ngo run ../../cmd/sst deploy","handlingStrategy":"retry","validationCode":"aws iam get-role --role-name AWSServiceRoleForRDS\n# or in Go before deploying:\n_, err := iamClient.GetRole(ctx, &iam.GetRoleInput{RoleName: aws.String(\"AWSServiceRoleForRDS\")})","typeGuard":null,"tryCatchPattern":"err := rdsRoleLookup.Create(input, &out)\nif err != nil && strings.Contains(err.Error(), \"cannot be found in your AWS account\") {\n    // account is new to RDS; schedule a retry after a delay\n    time.Sleep(10 * time.Minute)\n    err = rdsRoleLookup.Create(input, &out)\n}","preventionTips":["Activate RDS (or create the service-linked role) in a new account before the first sst deploy","Run aws iam get-role --role-name AWSServiceRoleForRDS as a pre-deploy check","Never manually delete AWS service-linked roles","Use the same AWS account/credentials profile you intend to deploy with when pre-checking"],"tags":["aws","iam","rds","timeout","retry-exhausted"],"backgroundTag":"aws-service-linked-role-missing","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}