AmazonAppStreamServiceAccess

The error you're encountering indicates an issue with the AmazonAppStreamServiceAccess service role in your AWS account. This role is essential for AppStream 2.0 to function properly, as it allows the AppStream 2.0 service to make API calls to other AWS services on your behalf.

To resolve this issue, you need to check whether the AmazonAppStreamServiceAccess service role exists in your account and has the correct policies attached. This role should be created automatically when you first start using AppStream 2.0 in an AWS Region.

Here's how to fix the problem:

1. Check if the role exists in your IAM console by searching for "AmazonAppStreamServiceAccess"

2. Verify that the role has the correct permissions policy attached (AmazonAppStreamServiceAccess policy)

3. Ensure the trust relationship policy is properly configured to allow the AppStream 2.0 service to assume this role

4. If the role is missing or incorrectly configured, you or an administrator with the required permissions will need to recreate it or fix the existing configuration

Without this properly configured service role, you cannot create AppStream 2.0 fleets or use certain AppStream 2.0 features. The role is mandatory for AppStream 2.0 to operate correctly within your AWS account.
Sources
Checking for the AmazonAppStreamServiceAccess Service Role and Policies - Amazon AppStream 2.0
Roles Required for AppStream 2.0, Application Auto Scaling, and AWS Certificate Manager Private CA - Amazon AppStream 2.0

You can resolve this issue by either creating the AppStream Service role automatically or by creating the role manually. If you experience any error when attempting to create the role automatically, please attempt the creation manually.

Below are the steps for both methods:

1. Creating the role Automatically:

a) Kindly delete the existing role “AmazonAppStreamServiceAccess”.

b) Navigate to the AppStream console and Click “Get started” with AppStream 2.0. If "Get Started" not available, login into a region where AppStream has not been used before.

Note - In order for AppStream to recreate the roles, you need to login to the AppStream console using an IAM role/User which has permissions for IAM and AppStream. AdministratorAccess permissions or permissions to create an IAM role and attach IAM policies to a role are required on the user/role committing this action.

c) If you would prefer an IAM user with minimum IAM permissions to recreate the AppStream roles, you can use the below policy for the IAM user along with AmazonAppStreamFullAccess permission to create the AppStream roles:

        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "iam:CreateRole",
                        "iam:ListRoles",
                        "iam:PassRole",
                        "iam:UpdateRoleDescription",
                        "iam:DeleteServiceLinkedRole",
                        "iam:GetServiceLinkedRoleDeletionStatus",
                        "iam:CreateServiceLinkedRole",
                        "iam:AttachRolePolicy",
                        "iam:PutRolePolicy"
                    ],
                    "Resource": "*"
                }
            ]
        }

2. Create the role Manually:

a) Delete the existing role “AmazonAppStreamServiceAccess” if available.

b) Create Trust Policy (Json file) AppStream-Role-Trust-Policy.json

        { 
            "Version": "2012-10-17", 
            "Statement": [ 
                { 
                    "Effect": "Allow", 
                    "Principal": { 
                        "Service": "appstream.amazonaws.com " 
                        }, 
                    "Action": "sts:AssumeRole" 
                } 
            ]
        }

c) Create role under path “service-role”

aws iam create-role --path /service-role/ --role-name AmazonAppStreamServiceAccess --assume-role-policy-document file:// AppStream-Role-Trust-Policy.json

d) Attach policy to the role

aws iam attach-role-policy --role-name AmazonAppStreamServiceAccess --policy-arn "arn:aws:iam::aws:policy/service-role/AmazonAppStreamServiceAccess"

Additionally, you can also verify that the AmazonAppStreamServiceAccess role is correct by reviewing the role arn is as follows:


arn:aws:iam::058891948171:role/service-role/AmazonAppStreamServiceAccess

I am a root user. Can you help me where should i proceed with step c) and further

I understand you're working as the root user and need guidance on step c) and the following steps. Let me walk you through this process.

Since you're the root user, you have all the necessary permissions to recreate the AppStream service role. Here's how to proceed with step c) and beyond:

Step c) Creating the Trust Policy File:

First, you'll need to create a JSON file on your local machine. You can do this using any text editor:

1. Open a text editor (like Notepad on Windows, TextEdit on Mac, or any code editor)
2. Copy and paste this content:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "appstream.amazonaws.com"
                ]
            },
            "Action": [
                "sts:AssumeRole"
            ]
        }
    ]
}

3. Save this file as AppStream-Role-Trust-Policy.json in a location you can easily access (like your Desktop or Documents folder)

Step d) Create the Role:

Open your command line interface (AWS CLI) and run this command. Make sure to include the full path to where you saved the JSON file:

aws iam create-role --path /service-role/ --role-name AmazonAppStreamServiceAccess --assume-role-policy-document file://AppStream-Role-Trust-Policy.json

If you saved the file on your Desktop, the command would look something like:

• Windows: file://C:\Users\YourUsername\Desktop\AppStream-Role-Trust-Policy.json
• Mac/Linux: file:///Users/YourUsername/Desktop/AppStream-Role-Trust-Policy.json

Step e) Attach the Policy:

Once the role is created successfully, attach the required policy:

aws iam attach-role-policy --role-name AmazonAppStreamServiceAccess --policy-arn "arn:aws:iam::aws:policy/service-role/AmazonAppStreamServiceAccess"

After completing these steps, your AppStream service role should be properly configured and the error should resolve.

Let me know if you run into any issues with these commands or need clarification on any of the steps.

Manually - via the AWS CloudShell terminal |>_ |

Creating the Trust Policy File:

First, create a JSON file on your local machine. You can do this using any text editor:

1. Open a text editor (like Notepad on Windows, TextEdit on Mac formatted in Plain Text, or any code editor)
2. Copy and paste this content into the file:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
           "Effect": "Allow",
           "Principal": {
                "Service": [
                    "appstream.amazonaws.com"
                ]
            },
            "Action": [
                "sts:AssumeRole"
            ]
        }
    ]
}

3. Save this file as AppStream-Role-Trust-Policy.json

Uploading the file to an S3 bucket:

Open the AWS Console, and navigate to "S3" to either create a bucket to put our new file in or use an existing bucket. Once you have a bucket:

1. Upload the "AppStream-Role-Trust-Policy.json" file to your bucket
2. Ensure that the file type reads as "JSON". If not, click on "Actions"-->rename object, and edit the file to end in ".json"

Creating the AppStream role:

To create the role, look for and click on the CloudShell symbol |>_| (located near the search bar, the bell, and the question mark in a circle). Once the terminal is loaded up, copy and paste the command below:

aws iam create-role --path /service-role/ --role-name AmazonAppStreamServiceAccess --assume-role-policy-document "$(aws s3 cp s3://aws-my->bucket-path/AppStream-Role-Trust-Policy.json -)"

• **Replace "s3://aws-my-bucket-path/AppStream-Role-Trust-Policy.json" with the S3 URI of your file.
• **Make sure to include " -)" to have your file passed directly to the create-role command.

Once the command has successfully finished, you will see an output of the content of your file. Type in "q" in the terminal and hit enter to exit the standard output. Your role should now be created and you can check that the role ARN has the proper path like so "arn:aws:iam::000000000000:role/service-role/AmazonAppStreamServiceAccess". Once the role creation is verified, you can attach the required policy via the console or with this command:

aws iam attach-role-policy --role-name AmazonAppStreamServiceAccess --policy-arn "arn:aws:iam::aws:policy/service->role/AmazonAppStreamServiceAccess"

Once finished with all the steps above, your new AppStream service role should resolve the error.

**Extra

Remember to clean up your environment by deleting the file you just uploaded (and also the bucket, if you created a new one for this) You can use the AWS Console directly, or the CloudShell terminal for this by replacing the S3 URI below with the appropriate value.

Removing the JSON file:

aws s3 rm s3://aws-my->bucket-path/AppStream-Role-Trust-Policy.json