EventBridge Scheduler cannot assume role restricted by ScheduleGroup ARN

Question

Hello, I am migrating an IAM role's trust policy to limit access using the ScheduleGroup ARN instead of Schedule ARN in accordance with https://docs.aws.amazon.com/scheduler/latest/UserGuide/cross-service-confused-deputy-prevention.html

I only want to allow schedules in the default schedule group to assume the role, so my trust policy is:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "scheduler.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceArn": "arn:aws:scheduler:::schedule-group/default",
                    "aws:SourceAccount": ""
                }
            }
        }
    ]
}
```

However, when I attempt to create a schedule in the default schedule group through the AWS web console, I get the error **"The execution role you provide must allow AWS EventBridge Scheduler to assume the role."**

Even using StringLike and `arn:aws:scheduler:*::schedule-group/*` for aws:SourceArn results in the same error. Reverting back to using the Schedule ARN still works.

What am I missing? Do I need to somehow tell EventBridge Scheduler to present a ScheduleGroup ARN instead of a Schedule ARN?

---

**Edit to add CloudTrail logs:**

UpdateAssumeRolePolicy:
```
{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Root",
        "principalId": "XXXXXXXXXX",
        "arn": "arn:aws:iam::XXXXXXXXXX:root",
        "accountId": "XXXXXXXXXX",
        "accessKeyId": "XXXXXXXXXX",
        "sessionContext": {
            "sessionIssuer": {},
            "webIdFederationData": {},
            "attributes": {
                "creationDate": "2023-10-25T12:52:40Z",
                "mfaAuthenticated": "true"
            }
        }
    },
    "eventTime": "2023-10-25T13:56:38Z",
    "eventSource": "iam.amazonaws.com",
    "eventName": "UpdateAssumeRolePolicy",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "XXXXXXXXXX",
    "userAgent": "AWS Internal",
    "requestParameters": {
        "policyDocument": "{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"Service": "scheduler.amazonaws.com"
			},
			"Action": "sts:AssumeRole",
			"Condition": {
				"StringLike": {
					"aws:SourceAccount": "XXXXXXXXXX",
					"aws:SourceArn": "arn:aws:scheduler:*:XXXXXXXXXX:schedule-group/*"
				}
			}
		}
	]
}",
        "roleName": "XXXXXXXXXX"
    },
    "responseElements": null,
    "requestID": "50709fc9-386a-4f95-be16-44cf9591e9f7",
    "eventID": "c80a532c-2295-4f00-84e4-36234e5c4389",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXX",
    "eventCategory": "Management",
    "sessionCredentialFromConsole": "true"
}
```

Subsequent CreateSchedule:
```
{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Root",
        "principalId": "XXXXXXXXXX",
        "arn": "arn:aws:iam::XXXXXXXXXX:root",
        "accountId": "XXXXXXXXXX",
        "accessKeyId": "XXXXXXXXXX",
        "sessionContext": {
            "sessionIssuer": {},
            "webIdFederationData": {},
            "attributes": {
                "creationDate": "2023-10-25T12:52:40Z",
                "mfaAuthenticated": "true"
            }
        }
    },
    "eventTime": "2023-10-25T14:02:57Z",
    "eventSource": "scheduler.amazonaws.com",
    "eventName": "CreateSchedule",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "XXXXXXXXXX",
    "userAgent": "XXXXXXXXXX",
    "errorCode": "ValidationException",
    "errorMessage": "The execution role you provide must allow AWS EventBridge Scheduler to assume the role.",
    "requestParameters": {
        "name": "create_schedule_test",
        "scheduleExpression": "at(2023-10-26T11:11:00)",
        "description": "",
        "scheduleExpressionTimezone": "America/New_York",
        "state": "ENABLED",
        "flexibleTimeWindow": {
            "mode": "OFF"
        },
        "clientToken": "XXXXXXXXXX"
    },
    "responseElements": null,
    "requestID": "4edc45a0-e62b-478a-93ee-63ddadfcd8a8",
    "eventID": "03773412-bf04-492d-b9e4-ed0e61b342ec",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "XXXXXXXXXX",
    "eventCategory": "Management",
    "tlsDetails": {
        "clientProvidedHostHeader": "scheduler.us-east-1.amazonaws.com"
    },
    "sessionCredentialFromConsole": "true"
}
```

Answer

Not sure if you are using your scheduler group in your trust policy instead of default as mentioned below.

aws:SourceArn": "arn:aws:scheduler:us-west-2:123456789012:schedule-group/your-schedule-group

Answer

Hi,

I have tried the below condition but cannot reproduce the error:

"Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "123456789012",
                    "aws:SourceArn": "arn:aws:scheduler:us-east-1:123456789012:schedule-group/default"
                }
            }

Did you use the AWS console or AWS CLI for the API call? If without the condition, does your call pass? Please also make sure the region is correct.

EventBridge Scheduler cannot assume role restricted by ScheduleGroup ARN

Relevant content