How do I resolve issues when I use the AWS Management Console to switch IAM roles?

Short description

You receive the Invalid information in one or more fields error message because of an incorrectly configured policy. You might also receive their error message when your request doesn't meet the conditions of a trust policy.

Resolution

Configure the AssumeRole permissions for your IAM user or role

To grant a user permissions to switch roles, add the AWS Security Token Service (AWS STS) AssumeRole action to your IAM identity's policy.

Example policy:

{ 
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::account_id_number:role/role-name-you-want-to-assume"  
   }
}

Note: Replace the arn:aws:iam::account_id_number:role/role-name-you-want-to assume with the Amazon Resource Name (ARN) of the IAM role.

Check that the IAM role's trust policy includes a principal

Update the trust policy to include a principal. The principal can be an IAM user or role, or an AWS account.

Note: If you add an account as a trusted principal, then all identities in that account can assume the role. However, the identities must have the AssumeRole permission.

For example, IAM user Carlos in Account ID 111222333444 wants to assume the Maria role in Account ID 444555666777.

Account ID 111222333444 is the trusted account, and Account ID 444555666777 is the trusting account. Maria's IAM role has a trust policy that trusts Carlos.

Example trust policy for the IAM role of Maria:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Principal": {
        "AWS": "arn:aws:iam::111222333444:user/Carlos"
      },
      "Condition": {}
    }
  ]
}

Carlos must also have an IAM policy to assume the IAM role of Maria in the other account.

Example IAM policy for Carlos to assume the IAM role of Maria:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::444555666777:role/Maria"
    }
  ]
}

To allow all IAM identities in an account to assume the role, use the account root principal.

In the trust policy of Maria's IAM role, replace user/Carlos with root:

"AWS": "arn:aws:iam::111222333444:root"

In the trust policy of Maria's IAM role, you can also use the wildcard (*) so that the user can assume any role in any account:

"Resource": "arn:aws:iam::444555666777:role/\\\*"

The preceding changes allow any IAM user or role in account 111222333444 to assume Maria's IAM role that's in account ID 444555666777. To minimize the number of identities who can assume the role, it's a best practice to specify the ARN of only the IAM user or role that requires access.

For more information, see Update a role trust policy.

Explicit deny from SCPs or an IAM policy

If your account is part of AWS Organizations, then the management account might apply service control policies (SCPs) that restrict role switching. For more information, see Best practices for the management account.

Check if there's an explicit Deny for the AssumeRole action in either the SCP or the IAM policy. If there is an explicit Deny, the deny overrides any Allow permissions, which prevents the role assumption. In the previous example, if there is an explicit Deny, Carlos can't assume Maria's IAM role.

Also, check if the SCPs restrict access based on AWS Regions. AWS STS is a global service, so you must list it in the global service exclusion list.

For more information, see Deny access to AWS based on the requested AWS Region.

Role requires an sts:ExternalId to switch to the IAM role

If the IAM role requires an sts:ExternalId key, then you can use the AWS Management Console to switch roles. Edit the policy to use the AssumeRole action with the sts:ExternalId parameter.

The sts:ExternalId key allows third-party access to AWS resources.

For more information, see Access to AWS accounts owned by third parties.

Check conditions in the IAM role trust policy

Review the conditions that you configured in the trust policy, such as an expiration date or ExternalId requirement. Your request must meet the conditions of the IAM role policy.

For example, if the current date is after the specified date, then the condition is false and the policy can't grant permission to assume the role.

The following policy denies permission to assume the role after May 1, 2016:

{
  "Effect": "Allow",
  "Action": "sts:AssumeRole",
  "Resource": "arn:aws:iam::account_id_number:role/role-name-you-want-to-assume",
  "Condition": {
    "DateLessThan": {
      "aws:CurrentTime": "2016-05-01T12:00:00Z"
    }
  }
}

Make sure your request satisfies all conditions in the trust policy.

Related information

How do I provide IAM users with a link to assume an IAM role?

How do I use IAM to access resources in another AWS account?

What's the difference between an AWS Organizations service control policy and an IAM policy?