title: AWSSecurityTokenServiceException: Acced denied. User is not authorized to perform sts:AssumeRole
body: <p>I'm new to aws. I want to generate temporary credentials for aws call. And for that I use example from <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/AuthUsingTempSessionTokenJava.html" rel="nofollow noreferrer">Making Requests Using IAM User Temporary Credentials - AWS SDK for Java</a></p>
  
  <p>Where I pass </p>
  
  <pre><code>String clientRegion = "&lt;specific region&gt;";
  String roleARN = "&lt;ARN from role&gt;";
  String roleSessionName = "Just random string"; //&lt;-- maybe I should pass specific SessionName?
  String bucketName = "&lt;specific bucket name&gt;";
  </code></pre>
  
  <p>And when trying assume role</p>
  
  <pre><code>stsClient.assumeRole(roleRequest);
  </code></pre>
  
  <p>get an error </p>
  
  <blockquote>
    <p>com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException:
    User: arn:aws:iam:::user/ is not authorized to perform:</p>
  
  <pre><code>sts:AssumeRole on resource: arn:aws:iam::&lt;ID&gt;:role/&lt;ROLE_NAME&gt; (Service: AWSSecurityTokenService; Status Code: 403; Error Code:
  </code></pre>
    
    <p>AccessDenied; Request ID:)</p>
  </blockquote>
  
  <p>I have a <strong>cognito</strong> role.
  I think the problem in <strong>role Trust Relationship</strong> settings.
  It looks like this:</p>
  
  <pre><code>    {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::&lt;iam user ID&gt;:user/&lt;USER_NAME&gt;",
          "Federated": "cognito-identity.amazonaws.com"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
          "StringEquals": {
            "cognito-identity.amazonaws.com:aud": "&lt;user pool ID&gt;"
          },
          "ForAnyValue:StringLike": {
            "cognito-identity.amazonaws.com:amr": "authenticated"
          }
        }
      }
    ]
  }
  </code></pre>
  
  <p>and <strong>user policy</strong> (This user policy is <strong>attached</strong> to this Role also):</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "&lt;sidId1&gt;",
              "Effect": "Allow",
              "Action": [
                  "s3:PutObject",
                  "s3:PutObjectAcl"
              ],
              "Resource": [
                  "arn:aws:s3:::&lt;path&gt;*"
              ]
          },
          {
              "Sid": "sidId2",
              "Effect": "Allow",
              "Action": [
                  "sts:AssumeRole",
                  "sts:AssumeRoleWithWebIdentity"
              ],
              "Resource": [
                  "arn:aws:iam::&lt;ID&gt;:role/&lt;ROLE_NAME&gt;"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>User policy has two warnings:</p>
  
  <p><a href="https://i.stack.imgur.com/fvG80.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fvG80.png" alt="enter image description here"></a>
  What I'm doing wrong?</p>
  
  <p><strong>UPD</strong>
  I changed role <strong>Trust relationship</strong>, just delete <strong>Condition</strong>:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Federated": "cognito-identity.amazonaws.com",
          "AWS": "arn:aws:iam::&lt;ID&gt;:user/&lt;USER&gt;"
        },
        "Action": [
          "sts:AssumeRole",
          "sts:AssumeRoleWithWebIdentity"
        ]
      }
    ]
  }
  </code></pre>
  
  <p>and now <strong>Access denied</strong> error occurred on another line of code:</p>
  
  <pre><code>  // Verify that assuming the role worked and the permissions are set correctly
    // by getting a set of object keys from the bucket.
    ObjectListing objects = s3Client.listObjects(bucketName);
  </code></pre>
  
  <p>Received error response: com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: ), S3 Extended Request ID:</p>