Amplify deployments are failing due to error saying Unable to assume specified IAM Role (Backend app)

Question

Hello,
I have been using AWS Amplify Gen 2 without any issues until 1 month back. But Yesterday when I pushed some code and tried to deploy it, it failed. The error I got was:

```
2025-07-24T00:22:12.992Z [ERROR]: !!! Unable to assume specified IAM Role. Please ensure the selected IAM Role has sufficient permissions and the Trust Relationship is configured correctly.
1
2025-07-24T00:22:13.079Z [INFO]: # Starting environment caching...
2
2025-07-24T00:22:13.079Z [INFO]: # Environment caching completed
3
```

I tried deleting and recreating roles for amplify, tried giving it aws admin permissions, checked the trust policy, everything is proper. I hadn't made any changes to any of the settings related to aws amplify as well. So I tried redeploying an app for which I had made no changes and to my surprise that failed too. So what could be the issue?

My current trust policy is:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "amplify.ap-south-1.amazonaws.com",
                    "amplify.amazonaws.com"
                ]
            },
            "Action": [
                "sts:AssumeRole"
            ]
        }
    ]
}
```

My previous trust policy was:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "amplify.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

None of this works. So can someone please help me?

re:Post Agent · Answer

Based on your error message and the information provided, this is a common issue with AWS Amplify deployments failing to assume the specified IAM role. Here are several potential solutions to resolve this issue:

1. **Trust Relationship Configuration**: Your updated trust policy looks correct as it includes both the regional Amplify service (`amplify.ap-south-1.amazonaws.com`) and the general Amplify service (`amplify.amazonaws.com`). This is the recommended approach.

2. **IAM Role Permissions**: Ensure that the IAM role has the necessary permissions attached. The role should typically have policies like `AdministratorAccess` and `AdministratorAccess-Amplify` attached to it.

3. **Check for Restrictive Inline Policies**: Verify that there are no restrictive inline policies attached to the role that might be limiting its capabilities.

4. **Region Consistency**: Confirm that all AWS resources related to your Amplify app are in the same region (ap-south-1 in your case).

5. **CloudTrail Logs**: Review your CloudTrail logs for any denied API calls related to AssumeRole actions, which might provide more specific information about why the role assumption is failing.

6. **User Permissions**: Ensure that the IAM user or role you're using to deploy has permission to call `sts:AssumeRole` for the role that Amplify needs to assume.

7. **Cache Issues**: Try invalidating the cache or deploying a fresh version of the app.

Since you mentioned that this issue started occurring recently without any changes to your settings, it's possible that there might have been some changes to the AWS environment or service configurations. If the problem persists after checking all these items, you might need to contact AWS Support for more specific assistance.  
**Sources**  
[Unable to Assume IAM Role in AWS Amplify Deployment | AWS re:Post](https://repost.aws/questions/QUJvInbGIsRdqH1Y0s4GDfsw/unable-to-assume-iam-role-in-aws-amplify-deployment)  
[on amplify react app deploy issue | AWS re:Post](https://repost.aws/questions/QUly0RHs5hSWadDeqOuvWJPA/on-amplify-react-app-deploy-issue)  
[Amplify Error - Unable to assume IAM Role | AWS re:Post](https://repost.aws/questions/QUgMUtAemYTfuxKKD314VmRA/amplify-error-unable-to-assume-iam-role)  
["mcurrent credentials could not be used to assume *** role" error during amolify deployment | AWS re:Post](https://repost.aws/questions/QUa7em0XmTSqK4SJcuXtyMwA/mcurrent-credentials-could-not-be-used-to-assume-role-error-during-amolify-deployment)  
[Troubleshoot IAM roles - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html)

Amplify deployments are failing due to error saying Unable to assume specified IAM Role (Backend app)

Add your answer

Relevant content