Amplify Hosting (SSR) cannot access Aurora DSQL - IAM role credentials not passed to Lambda environment

Question

## Environment

* **Region**: ap-northeast-1
* **Framework**: Nuxt.js 4.1.2 (SSR enabled)
* **Hosting**: AWS Amplify Hosting with SSR enabled
* **Database**: Aurora DSQL cluster
* **IAM**: Service Role configured with `dsql:DbConnect` and `dsql:DbConnectAdmin` permissions

## Issue

When trying to connect to Aurora DSQL from Amplify Hosting SSR environment, I cannot obtain IAM credentials to generate the authentication token.

**Error message:**
```
Could not load credentials from any providers
```

**CloudWatch Logs show:**
```javascript
{
  lambdaEnv: true,
  hasAccessKeyId: false,
  hasSecretAccessKey: false,
  hasSessionToken: false,
  hasContainerCredentials: false,  // ← The problem
  hasEC2Metadata: false,
  awsRegion: 'ap-northeast-1',
  awsExecutionEnv: 'AWS_Lambda_nodejs20.x'
}
```

This is similar to [this question](https://repost.aws/questions/QUuij_r4R5TK6e6-rD6rLHlw/access-denied-error-when-trying-to-access-and-query-my-aurora-dsql-cluster), but in my case, I cannot even obtain IAM credentials in the first place.

## What I've tried

### 1. Created and configured IAM service role

**Policies attached:**
* `dsql:DbConnect`
* `dsql:DbConnectAdmin`
* `s3:GetObject`, `s3:PutObject` (for S3 access)

### 2. Trust relationship includes both services

```json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "Service": [
        "amplify.amazonaws.com",
        "lambda.amazonaws.com"
      ]
    },
    "Action": "sts:AssumeRole"
  }]
}
```

### 3. Configured service role in Amplify Console

* Navigate to: **App Settings → General → Service Role**
* Selected the IAM role created above

### 4. Tried to set AWS_ROLE_ARN environment variable

* **Result**: Error - "Environment variables cannot start with the reserved prefix 'AWS'"

### 5. Redeployed multiple times

* No change in behavior

## Additional Context

**Works in other environments:**
* ✅ Local development (using AWS CLI credentials)
* ✅ Manually created Lambda functions (e.g., Cognito triggers) with IAM roles
* ❌ Amplify Hosting SSR Lambda environment

**Code sample:**
```javascript
import { DsqlSigner } from '@aws-sdk/dsql-signer';

const signer = new DsqlSigner({
  hostname: process.env.AURORA_DSQL_ENDPOINT,
  region: 'ap-northeast-1',
  // No credentials available here in Amplify SSR
});

// Fails here - cannot obtain credentials
const token = await signer.getDbConnectAdminAuthToken();
```

## Questions

1. Does Amplify Hosting (SSR) Lambda environment properly pass IAM role credentials from the service role to the execution environment?
2. Is there a specific configuration or workaround to make container credentials (`AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`) available in Amplify SSR?
3. Is this a known limitation of Amplify Hosting SSR?
4. What is the recommended architecture for connecting to Aurora DSQL from Amplify Hosting?
   * Should I use API Gateway + Lambda instead?
   * Is Amplify Gen 2 with CDK required for this use case?

## Workarounds Considered

1. Using IAM user access keys (not recommended for security)
2. Moving to API Gateway + Lambda architecture
3. Migrating to Amplify Gen 2 with CDK-defined backend resources

Any guidance would be greatly appreciated. Thank you!

Riku_Kobayashi · Accepted Answer

Hello.

I think you may need to configure a Compute Role rather than a Service Role.  
https://aws.amazon.com/jp/blogs/mobile/iam-compute-roles-for-server-side-rendering-with-aws-amplify-hosting/

re:Post Agent · Answer

The issue you're experiencing is related to how IAM roles and credentials are passed between services in AWS Amplify's SSR environment. Let me address your specific questions and provide some guidance.

## Root Cause Analysis

The core issue is that the IAM service role you've configured for Amplify isn't properly being assumed by the Lambda functions that power your SSR environment. While your trust relationship includes both `amplify.amazonaws.com` and `lambda.amazonaws.com`, there appears to be a disconnect in how these credentials are being passed to the Lambda execution environment.

## Addressing Your Questions

1. **Does Amplify Hosting (SSR) Lambda environment properly pass IAM role credentials?**

Based on your logs showing `hasContainerCredentials: false`, it appears the Lambda environment isn't receiving the container credentials it needs. This suggests the IAM role assumption chain isn't working as expected between Amplify and the Lambda functions it creates for SSR.

2. **Is there a specific configuration for container credentials?**

The issue might be related to the trust relationship configuration. When Amplify creates Lambda functions for SSR, it needs to be able to pass the role to those functions.

3. **Is this a known limitation?**

This appears to be related to the `iam:PassRole` permission issue. Amplify needs to be able to pass the role to the Lambda service, but there might be a missing permission or trust relationship configuration.

## Recommended Solutions

1. **Update Trust Relationship Policy**

Ensure your trust policy includes both regional and general service endpoints:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"amplify.ap-northeast-1.amazonaws.com", 
"amplify.amazonaws.com",
"lambda.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
}
```

2. **Check IAM Permissions**

Ensure the IAM user or role deploying the Amplify app has the `iam:PassRole` permission to pass roles to both Amplify and Lambda services.

3. **Add Required Policies**

Make sure your service role has all necessary permissions:
- `AdministratorAccess-Amplify` (or equivalent)
- The DSQL permissions you've already added
- Lambda execution permissions

4. **Architecture Recommendations**

If the issue persists:
- Using API Gateway + Lambda is a valid alternative architecture that gives you more control over IAM roles
- Amplify Gen 2 with CDK would provide more fine-grained control over resource creation and permissions

5. **Temporary Workaround**

If you need a quick solution while investigating further, you could create a separate Lambda function with the correct permissions and have your SSR application call this Lambda to interact with Aurora DSQL.

## Additional Troubleshooting Steps

1. Check CloudTrail logs for any denied `AssumeRole` actions
2. Verify all AWS resources are in the same region (ap-northeast-1)
3. Review any inline policies that might be restricting access
4. Try invalidating the cache or deploying a fresh version of the app

The most likely issue is related to the IAM role trust relationship and permissions needed for Amplify to pass the role to Lambda for SSR execution.  
**Sources**  
[Troubleshooting Amazon Aurora DSQL identity and access - Amazon Aurora DSQL](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/security_iam_troubleshoot.html)  
[Amplify Error - Unable to assume IAM Role | AWS re:Post](https://repost.aws/questions/QUgMUtAemYTfuxKKD314VmRA/amplify-error-unable-to-assume-iam-role)  
[on amplify react app deploy issue | AWS re:Post](https://repost.aws/questions/QUly0RHs5hSWadDeqOuvWJPA/on-amplify-react-app-deploy-issue)

Amplify Hosting (SSR) cannot access Aurora DSQL - IAM role credentials not passed to Lambda environment

Environment

Issue

What I've tried

1. Created and configured IAM service role

2. Trust relationship includes both services

3. Configured service role in Amplify Console

4. Tried to set AWS_ROLE_ARN environment variable

5. Redeployed multiple times

Additional Context

Questions

Workarounds Considered

Root Cause Analysis

Addressing Your Questions

Recommended Solutions

Additional Troubleshooting Steps

Add your answer

Relevant content