By using AWS re:Post, you agree to the Terms of Use
/Elastic Beanstalk, Unable to assume role "arn:aws:iam::xxxxxxx:role/aws-elasticbeanstalk-service-role". Verify that the role exists and is configured correctly./

Elastic Beanstalk, Unable to assume role "arn:aws:iam::xxxxxxx:role/aws-elasticbeanstalk-service-role". Verify that the role exists and is configured correctly.

0

One of My Beanstalk environment started to be in sever/degraded status and showing me the error

Unable to assume role "arn:aws:iam::xxxxxx:role/aws-elasticbeanstalk-service-role". Verify that the role exists and is configured correctly.

Upon checking, there is nothing changed in this service role, and all my other EB enviornment using this service role works fine. The service role has two managed policis (AWSElasticBeanstalkEnhancedHealth & AWSElasticBeanstalkService) attached with proper trust relashionship setup as below. I also confirmed my USER IAM policy is Admin, which give access to do anything (including assume/pass roles). What else can be causing this error? How do I fix it

{ "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "elasticbeanstalk.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "elasticbeanstalk" } } } ] }

1 Answers
0

Hi,

From the case notes I understand that you are getting the error Unable to assume role "arn:aws:iam::xxxxxx:role/aws-elasticbeanstalk-service-role", in your elastic beanstalk environment.

Per the Elastic Beanstalk documentation the trust policy that you have for your service role is correct. I am attaching the following documentation for that here (1). After testing I was not able to replicate this issue in my account as Elastic Beanstalk was successfully able to assume the service role with this trust policy. Based off of this I would recommend opening a case with AWS support in order to allow a support engineer to better troubleshoot the issue.

I hope you have a great rest of your day!

References

(1) https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/iam-servicerole.html#iam-servicerole-console

SUPPORT ENGINEER
answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions