How do I resolve "not authorized to assume the provided role" errors in AWS Step Functions?

Resolution

Verify that you configured the required trust relationships for the IAM role that your state machine assumes

One of the following endpoints must be listed as a trusted entity in the AWS Identity and Access Management (IAM) role's trust policy:

• An AWS Regional endpoint: states.region.amazonaws.com
• The AWS global endpoint: states.amazonaws.com

Use the IAM console to update the IAM role's trust policy so that the policy includes one of the preceding endpoints.

Note: When you call the StartExecution API action, Step Functions uses the IAM role that's associated with the state machine during the API action's runtime. If you change the IAM role during the action's runtime, then Step Functions doesn't use the IAM role on the API action.

Verify that the IAM role that your state machine assumes still exists

Complete the following steps:

1. Open the Step Functions console.
2. In the navigation pane, choose State machines.
3. For Names, choose the name of your state machine.
4. In the Details section, choose the link under IAM role ARN. If the IAM role exists, then the role opens on the IAM console. If the IAM role doesn't exist, then the IAM console opens a page that says No Entity Found.

If the IAM role that your state machine assumes doesn't exist, then create a new IAM role that includes the required permissions. Then, configure your state machine to assume the new IAM role. 
Important: The new IAM role must have a different name from the previous IAM role.

For more information, see How AWS Step Functions works with IAM.

Related information

Create a serverless workflow with AWS Step Functions and AWS Lambda