title: AWS Redshift: Masteruser not authorized to assume role
body: <p>I created a cloudformation stack with redshift cluster and a masteruser: testuser</p>
  
  <pre><code>"RedshiftCluster" : {
    "IamRoles" : [
        {
          "Fn::GetAtt": [
            "IAMInstanceRole",
            "Arn"
          ]
        }
      ]
    ... other configurations
  </code></pre>
  
  <p>It uses the below IAM role (IAMInstanceRole) which is in in-sync status and the redshift cluster is up and running:</p>
  
  <pre><code>"IAMInstanceRole": {
    "Properties": {
      "RoleName": "test-iam-role",
      "AssumeRolePolicyDocument": {
        "Statement": [
          {
            "Action": [
              "sts:AssumeRole"
            ],
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "ec2.amazonaws.com",
                "redshift.amazonaws.com",
                "s3.amazonaws.com"
              ]
            }
          }
        ]
      },
      "Path": "/",
      "Policies": [ 
        {
        "PolicyName": "root",
          "PolicyDocument": {
            "Version" : "2012-10-17",
            "Statement": [ 
              {
                "Effect": "Allow",
                "Action": "*",
                "Resource": "*"
              }
            ]
          }
        } 
      ]
    }
  </code></pre>
  
  <p>I'm trying to load csv file from s3 to redshift using copy command and iam_role as credential. The iam_role has the arn of IAMInstanceRole (declared above).
  Whenever I execute the below command:</p>
  
  <pre><code>copy test_table from 's3://test-bucket/test.csv' CREDENTIALS 'aws_iam_role=arn:aws:iam::&lt;account-id&gt;:role/test-iam-role' MAXERROR 100000 removequotes TRIMBLANKS emptyasnull blanksasnull delimiter '|';
  </code></pre>
  
  <p>I get the error:</p>
  
  <pre><code>ERROR:  User arn:aws:redshift:us-west-2:189675173661:dbuser:automated-data-sanity-redshiftcluster-fbp9fgls6lri/sanityuser is not authorized to assume IAM Role arn:aws:iam::189675173661:role/sanity-test-iam-instance-role
  DETAIL:
  
  
  
  
  -----------------------------------------------
    error:  User arn:aws:redshift:us-west-2:&lt;account-id&gt;:dbuser:test-redshiftcluster-fbp9fgls6lri/testuser is not authorized to assume IAM Role arn:aws:iam::&lt;account-id&gt;:role/test-iam-role
    code:      8001
    context:   IAM Role=arn:aws:iam::&lt;account-id&gt;:role/test-iam-role
    query:     1139
    location:  xen_aws_credentials_mgr.cpp:236
    process:   padbmaster [pid=29280]
    -----------------------------------------------
  </code></pre>
  
  <p>Please suggest some resolution.</p>