Firehose service role with external ID

Question

I created a service role with the following trust relationship:

```{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "firehose.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "abcd1234dcba"
                }
            }
        }
    ]
}```

When I try to use this role to create a Firehose Delivery Stream, I get this error:

`Firehose is unable to assume role arn:aws:iam::111111111111:role/myservicerolewithexternalid. Please check the role provided.`

I assume this is because the Firehose service is not passing the external id when trying to create the Deliver Stream.  Strangely this DOES work if I set the external ID in the trust relationship to be the AWS account number, but no other external ID seems to work.

How do services  (specifically  Data Firehose) pass an external id when trying to assume service roles?

re:Post Agent · Answer

When creating a service role for Amazon Kinesis Data Firehose with an external ID condition, you need to use your AWS account ID as the external ID value. This is a specific requirement for Firehose service roles.

Based on your experience, you've already discovered that using your AWS account number as the external ID works, while custom values like "abcd1234dcba" do not. This is because Firehose is designed to automatically use the account ID as the external ID when assuming the role.

In the trust policy for Firehose, the correct approach is to set the external ID to your AWS account number (in your case, "111111111111") as shown in this example:

```
{
"Statement": {
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "111111111111"
}
}
}
}
```

The external ID condition helps prevent the confused deputy problem by ensuring that the service can only assume the role when acting on behalf of your specific account. For Firehose specifically, the service is designed to use your account ID as this identifier when making the AssumeRole API call.  
**Sources**  
[Step 1: Create a Firehose delivery stream - Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateFirehoseStream-Account.html)  
[Step 1: Create a Firehose delivery stream - Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateFirehoseStream.html)  
[Access to AWS accounts owned by third parties - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html)

Firehose service role with external ID

Add your answer

Relevant content