Unable to assume role

Question

When attempting to assume a role from a NextJS applicaion in order to access DynamoDB, the response is a 403 error message:

`User: arn:aws:sts::**********:assumed-role/AmplifyTestRole/AmplifyHostingCompute-app=************** is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::**********:role/AmplifyTestRole`

The documentation has been followed closely when setting up the role to be assumed by the NextJS application.
The following is the code for assuming the role:

```typescript
export async function assumeRole(sessionName: string): Promise {
    "use server";
    const stsClient = new STSClient({ region: "us-east-1" });
    const command = new AssumeRoleCommand({
        RoleArn: "*****************",
        RoleSessionName: sessionName,
        DurationSeconds: 900,
    });
    const assumeRole = await stsClient.send(command); // This is where the error must be happening

if (
        !assumeRole.Credentials ||
        !assumeRole.Credentials.AccessKeyId ||
        !assumeRole.Credentials.SecretAccessKey ||
        !assumeRole.Credentials.SessionToken
    ) {
        throw new Error("Failed to assume role or missing credentials.");
    }

return new AWS.Credentials({
        accessKeyId: assumeRole.Credentials.AccessKeyId,
        secretAccessKey: assumeRole.Credentials.SecretAccessKey,
        sessionToken: assumeRole.Credentials.SessionToken,
    });
}
```

The error message makes it appear that some cyclical error is happening (as in, the assumed role is attempting to assume a role again), however I believe from what I have seen online that this is just how this error message appears. If more information is needed from the configuration of the role and application, let me know, but as far as I am aware it has followed the documentation steps very closely. We have also been adjusting and delegating different configurations of permissions to try solving this issue.

re:Post Agent · Answer

Based on the error message and your code, it appears you're encountering a permission issue when trying to assume a role. The error indicates that the identity "AmplifyTestRole/AmplifyHostingCompute-app" is trying to assume the same role "AmplifyTestRole" but doesn't have permission to do so.

There are a few key issues to check:

1. **Trust Relationship Policy**: The IAM role you're trying to assume needs a trust policy that allows the service or entity to assume it. For Amplify applications, the trust policy should include both the regional Amplify service and the general Amplify service:

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": ["amplify.us-east-1.amazonaws.com", "amplify.amazonaws.com"]
},
"Action": "sts:AssumeRole"
}
]
}
```

2. **Circular Role Assumption**: The error suggests you might be trying to have a role assume itself, which isn't allowed. The error shows "AmplifyTestRole" trying to assume "AmplifyTestRole" again.

3. **IAM Permissions**: Ensure that the IAM identity executing the code has the necessary permissions to call `sts:AssumeRole` for the specific role. Your IAM policy should include something like:

```json
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::account_id_number:role/AmplifyTestRole"
}
```

4. **GitHub Repository Access**: If you're using GitHub with Amplify, verify that the AWS Amplify GitHub App has access to your repository. Sometimes deployments fail with "Unable to assume specified IAM Role" errors when the GitHub App loses access to the repository.

To resolve this issue:
- Review and update the trust policy of the role
- Ensure you're not trying to have a role assume itself
- Verify the IAM permissions of the executing identity
- Check GitHub repository access if applicable
- Consider invalidating the cache or deploying a fresh version of the app if the issue persists  
**Sources**  
[Amplify Error - Unable to assume IAM Role | AWS re:Post](https://repost.aws/questions/QUgMUtAemYTfuxKKD314VmRA/amplify-error-unable-to-assume-iam-role)  
[Troubleshoot IAM roles - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html)

Unable to assume role

Add your answer

Relevant content