Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

IAM Role for SP-API fails with "Invalid principal in policy" on a new standalone account

0

Hello everyone,

I'm facing a persistent issue while trying to create an IAM role for the Amazon Selling Partner API (SP-API), and I'm hoping someone in the community might have some insight, as I've exhausted the standard troubleshooting steps.

My goal is to create an IAM role that the SP-API service can assume. I have already tried using the official service principal method, which failed. My main issue is that even when I use the direct AWS Account ID method, every attempt fails with the same error:

ERROR: "Invalid principal in policy"

Here is a summary of my primary attempts:

Attempt 1: Using the AWS Account Principal

I tried the documented method of trusting the SP-API's official AWS Account ID.

Trust Policy JSON used: {

"Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::490152333827:root" }, "Action": "sts:AssumeRole" } ] }

Result: This failed with the error "Invalid principal in policy: "AWS":"arn:aws:iam::490152333827:root"".

Attempt 2: Using the IAM Visual Editor

To eliminate any possibility of typos or copy-paste errors, I used the IAM visual editor:

1、Selected "AWS account" as the trusted entity type.

2、Entered the Account ID "490152333827".

Result: This also failed with the same error "Invalid principal in policy: "AWS":"490152333827"".

Diagnostics and What I've Ruled Out

・ This is a new AWS Account (ID: 5062-7966-0479), and I am the root user/administrator.

・ It is NOT part of an AWS Organization. I have checked the AWS Organizations console, and it confirms this is a standalone account. Therefore, a Service Control Policy (SCP) should not be the cause.

・ The Account ID "490152333827" is correct according to the official SP-API documentation.

My Question

Given that the standard methods for establishing trust are failing on a new, standalone account, I am at a loss.

Has anyone encountered a situation like this? Are there any known temporary restrictions on brand-new AWS accounts that might prevent them from creating trust relationships with specific AWS services? Is there any other troubleshooting step I might be missing?

I have already opened a support case, but I was hoping the community might have seen this before.

Thank you for any help or insight you can provide.

Topics
Security, Identity, & Compliance
Tags
Service Control PolicyAWS Identity and Access ManagementIAM Roles Anywhere
Language
English

asked a year ago383 views

2 Answers
0

Based on the information provided, you're encountering an "Invalid principal in policy" error when trying to create an IAM role for the Amazon Selling Partner API (SP-API). This is a common issue that can occur for a few specific reasons.

First, it's important to understand that the error message suggests there's an issue with the principal element in your trust policy. When creating IAM roles, the principal element specifies who is allowed to assume the role.

Looking at your attempts, there are a couple of potential issues:

  1. For the Selling Partner API, there appears to be confusion about the correct service principal to use. Based on a similar issue reported by others, there might be a discrepancy between "sellingpartner.amazonaws.com" and "sellingpartnerap1.amazon.com" (note the "i" not "1" in "api").

  2. When using the AWS account principal method, ensure that you're formatting the JSON correctly. The error message showing "AWS":"arn:aws:iam::490152333827:root" suggests there might be an issue with the JSON syntax or formatting.

Here are some troubleshooting steps you can try:

  • Double-check the JSON syntax in your trust policy. Make sure there are no extra spaces, quotes, or other formatting issues.

  • Try using the correct service principal for SP-API. Based on community reports, you might want to try "sellingpartnerapi.amazon.com" (with an "i" not a "1").

  • When using the IAM visual editor, make sure you're selecting the correct trusted entity type and entering the account ID correctly.

  • If you're copying and pasting the policy, try manually typing it instead to avoid any hidden characters or formatting issues.

If you continue to face issues, it might be worth waiting for a response to your support case, as they can provide account-specific guidance. While there are some restrictions on new AWS accounts, they typically don't prevent creating trust relationships with specific AWS services in this manner.
Sources
Invalid principal in policy" when creating SP-API role – Despite correct "Service": "sellingpartner.amazonaws.com | AWS re:Post
IAM policy validation check reference - AWS Identity and Access Management
AWS re:Post Knowledge Center Spotlight: AWS Identity and Access Management (IAM) | AWS re:Post
IAM Error: Invalid principal 'SERVICE':'polly.amazonaws.com' in Role Trust Policy & S3 Bucket Policy (Multi-Region) | AWS re:Post

answered a year ago

0

The error message means that the AWS account whose ID you specified doesn't exist or has been suspended or closed. Which document are you looking at?

EXPERT

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content