title: User: arn:aws:sts::{account_id}:assumed-role/* is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::{account_id}:role/*
body: <p>I am creating two resources AWS Lambda function and Role using cloudformation template.<br />
  I am using role arn as Environment variable. Later using it in code for S3 connection.
  But getting exception as</p>
  <pre><code>com.amazonaws.services.securitytoken.model.AWSSecurityTokenServiceException: 
  User: arn:aws:sts::{account_id}:assumed-role/* is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::{account_id}:role/* 
  Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: ; Proxy: null)
  </code></pre>
  <p><strong>How can I add same role arn in Trust Relationship and in inline policy?</strong><br />
  <strong>How to overcome above exception?</strong></p>
  <p><strong>Other solutions appreciated</strong></p>
  <p>CF Template snippet</p>
  <pre class="lang-yaml prettyprint-override"><code>Resources:
    LambdaFunctionExecutionRole:
      Type: 'AWS::IAM::Role'
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
  #             AWS:
  #               - {Role ARN}
              Action:
                - 'sts:AssumeRole'
        Path: /
        ManagedPolicyArns:
          - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
          - 'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
          - 'arn:aws:iam::aws:policy/SecretsManagerReadWrite'
          - 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
          - 'arn:aws:iam::aws:policy/CloudWatchLogsFullAccess'
          - 'arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess'
          - 'arn:aws:iam::aws:policy/service-role/AWSLambdaRole'
        Policies:
        - PolicyName: CustomLambdaPolicy
          PolicyDocument:
            Statement:
            - Effect: Allow
              Action:
              - 'ec2:Describe*'
              - 'ec2:Get*'
              Resource: '*'
  
    LambdaFunction:
      Type: AWS::Serverless::Function
      Properties:
        Description: !Ref Name
        FunctionName: !Ref Name
        Handler: com.fileservice::handleRequest
        Role: !GetAtt LambdaFunctionExecutionRole.Arn
        Timeout: 900
        MemorySize: 512
        Environment:
          Variables:
            bucketName: !Ref S3BucketName
            roleARN: !GetAtt LambdaFunctionExecutionRole.Arn
        CodeUri: target/fileservice-1.0.0.jar
        Runtime: java11
  </code></pre>
  <p><strong>AWS S3 Connectivity Code Snippet</strong></p>
  <pre class="lang-java prettyprint-override"><code>public AmazonS3 connectS3(String roleArn, String region) {
      STSAssumeRoleSessionCredentialsProvider stsAssumeRoleSessionCredentialsProvider = new STSAssumeRoleSessionCredentialsProvider.Builder(
              roleArn, &quot;MySession&quot;).withStsClient(AWSSecurityTokenServiceClientBuilder.standard().build())
                      .withRoleSessionDurationSeconds(900).build();
  
      BasicSessionCredentials basicSessionCredentials = new BasicSessionCredentials(
              stsAssumeRoleSessionCredentialsProvider.getCredentials().getAWSAccessKeyId(),
              stsAssumeRoleSessionCredentialsProvider.getCredentials().getAWSSecretKey(),
              stsAssumeRoleSessionCredentialsProvider.getCredentials().getSessionToken());
  
      System.out.println(&quot;serviceEndpoint:- &quot;+ String.format(&quot;https://s3.%s.amazonaws.com&quot;, region) );
      AmazonS3 s3Client = AmazonS3ClientBuilder.standard().withCredentials(new AWSStaticCredentialsProvider(basicSessionCredentials))
                              .withEndpointConfiguration( new EndpointConfiguration( String.format(&quot;https://s3.%s.amazonaws.com&quot;, region), region) )
                              .build();
      return s3Client;
  }
  </code></pre>