Invalid principal in policy" when creating SP-API role – Despite correct "Service": "sellingpartner.amazonaws.com

Question

Issue:
I’m trying to create an IAM role for the Amazon Selling Partner API (SP-API) but consistently encounter this error:
"Error creating role AmazonSPAPIRole: Invalid principal in policy: 'Service':'sellingpartner.amazonaws.com'".

Steps taken: Used the following trust policy JSON (copied from AWS docs):

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "sellingpartner.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

Why is the principal "sellingpartner.amazonaws.com" flagged as invalid? Are there known limitations or additional steps?

Kidd Ip · Answer

Seems principal incorrect (replace 1 to i)

```
"Principal": {
  "Service": "sellingpartnerap1.amazon.com"
}
```

Michael · Answer

Thank you for your effort! Unfortunately, the error message doesn't go away!

Invalid principal in policy: "SERVICE":"sellingpartnerap1.amazon.com"

I used i not 1.

Could someone please tell me, why I get, Your text contains phrases (1.amazon.com) that are not allowed on re:Post. Please edit them before continuing. but 1 is i.

Invalid principal in policy" when creating SP-API role – Despite correct "Service": "sellingpartner.amazonaws.com

Add your answer

Relevant content