{"record":{"id":"efbbcb95e5fa07c0","repo":"FlowiseAI/Flowise","slug":"invalid-role-arn-format-expected-format-arn-aws","errorCode":null,"errorMessage":"Invalid Role ARN format: Expected format: arn:aws:iam::<12-digit-account-id>:role/<role-name>","messagePattern":"Invalid Role ARN format: Expected format: arn:aws:iam::<12-digit-account-id>:role/<role-name>","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/awsToolsUtils.ts","lineNumber":89,"sourceCode":" * @returns {Promise<AWSCredentialConfig>} Resolved credential configuration with optional\n *   `credentials` and `region` fields\n * @throws {Error} If STS AssumeRole fails (e.g., access denied, invalid Role ARN, wrong\n *   External ID) — The full error is logged server-side.\n */\nexport async function getAWSCredentialConfig(nodeData: INodeData, options: ICommonObject, region?: string): Promise<AWSCredentialConfig> {\n    const credentialData = await getCredentialData(nodeData.credential ?? '', options)\n    const awsRegion = region || DEFAULT_AWS_REGION\n\n    const accessKeyId = getCredentialParam('awsKey', credentialData, nodeData)\n    const secretAccessKey = getCredentialParam('awsSecret', credentialData, nodeData)\n    const sessionToken = getCredentialParam('awsSession', credentialData, nodeData)\n    const roleArn = getCredentialParam('roleArn', credentialData, nodeData)\n    const externalId = getCredentialParam('externalId', credentialData, nodeData)\n\n    // --- AssumeRole flow ---\n    if (roleArn) {\n        if (!AWS_ROLE_ARN_REGEX.test(roleArn)) {\n            throw new Error('Invalid Role ARN format: Expected format: arn:aws:iam::<12-digit-account-id>:role/<role-name>')\n        }\n        const assumedCredentials = await assumeRole({\n            accessKeyId,\n            secretAccessKey,\n            sessionToken,\n            roleArn,\n            externalId,\n            region: awsRegion,\n            logger: options.logger\n        })\n        return { credentials: assumedCredentials, region: awsRegion }\n    }\n\n    // --- Static credentials flow (backward-compatible) ---\n    if (accessKeyId && secretAccessKey) {\n        const credentials: AWSCredentials = {\n            accessKeyId,\n            secretAccessKey,","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/awsToolsUtils.ts#L71-L107","documentation":"getAWSCredentialConfig() validates roleArn against AWS_ROLE_ARN_REGEX `/^arn:aws(-[a-z]+(-[a-z]+)?)?:iam::\\d{12}:role\\/[\\w+=,.@/-]+$/` before calling STS. The regex requires the literal `role/` resource prefix, exactly 12 digits for the account id, and supports the aws / aws-cn / aws-us-gov partitions.","triggerScenarios":"roleArn credential param is malformed: missing the `role/` prefix (e.g. a user or policy ARN like `arn:aws:iam::123456789012:user/foo`), account id not exactly 12 digits, wrong partition, leading/trailing whitespace, copy-paste truncated the ARN, or a stray trailing slash only path mismatch.","commonSituations":"Copied the role ARN from the AWS console but truncated it; used a user/policy ARN by mistake; non-12-digit account id; China (aws-cn) or GovCloud (aws-us-gov) partition omitted; pasted with surrounding quotes or whitespace.","solutions":["Use the exact ARN from IAM Console -> Roles -> (role) -> Copy ARN. Format: `arn:aws:iam::123456789012:role/my-role`.","Ensure the account id is exactly 12 digits.","For aws-cn / aws-us-gov partitions use `arn:aws-cn:iam::...` / `arn:aws-us-gov:iam::...`.","Trim surrounding whitespace and remove wrapping quotes.","Confirm you copied a role ARN (resource starts with `role/`), not a user, policy, or instance-profile ARN."],"exampleFix":"// before\nroleArn = 'arn:aws:iam::12345678901:role/my-role'   // 11 digits\nroleArn = 'arn:aws:iam::123456789012:user/svc'        // wrong resource type\n\n// after\nroleArn = 'arn:aws:iam::123456789012:role/my-role'   // 12 digits, role/","handlingStrategy":"validation","validationCode":"// Validate the Role ARN format before passing it to getAWSCredentialConfig\nconst AWS_ROLE_ARN_REGEX = /^arn:aws(-[a-z]+(-[a-z]+)?)?:iam::\\d{12}:role\\/[\\w+=,.@/-]+$/\nfunction assertRoleArn(arn) {\n    if (!AWS_ROLE_ARN_REGEX.test(arn.trim())) {\n        throw new Error('Role ARN must be arn:<partition>:iam::<12-digit-id>:role/<name>')\n    }\n}","typeGuard":"function isValidRoleArn(arn) {\n    return typeof arn === 'string' && /^arn:aws(-[a-z]+(-[a-z]+)?)?:iam::\\d{12}:role\\/[\\w+=,.@/-]+$/.test(arn.trim())\n}","tryCatchPattern":"try {\n    const cfg = await getAWSCredentialConfig(nodeData, options, region)\n} catch (e) {\n    if (/Invalid Role ARN format/.test(e.message)) {\n        // ask the user to paste a fresh arn:aws:iam::<id>:role/<name> from the IAM console\n    }\n    throw e\n}","preventionTips":["Copy role ARNs from IAM Console -> Roles -> Copy ARN (resource prefix is always 'role/').","Trim whitespace and strip quotes before storing the credential.","For aws-cn / aws-us-gov partitions, include the partition segment."],"tags":["aws","iam","role-arn","validation","sts"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}