Cannot set up Connector for App Studio

Question

Using App Studio, I cannot get past the "App Studio was not able to assume the IAM role" error message. Here's the context:

I'm planning on making a phone app which would receive a message sent by a Lambda function. To that end, I created an IAM role with proper permissions and Trust relationship, as well as a role Tag (IsAppStudioDataAccessRole, value=true). On the App Studio "New Connector" setup page, I create a name for the Connector, provide the ARN for the role, and then test-verify the connection using the button right on that page. Here is the problem:

The "Verify" check always returns an error: "App Studio was not able to assume the IAM role", and suggests I do 2 things: (1) Verify that the role has the tag and value (mentioned above) and (2) that the role have a specific trust policy (which I copied/pasted - using my actual Acct# and AppStudioID. I double checked the Instant-IDs (from the App Studio Account Settings page), even re-typed them to avoid "hidden character" issues. I did code reviews with AI tools, but nothing came out of it. I deleted the role and started over. Nothing gets me past the "Verify" step. I'm out of ideas

Any help would be greatly appreciated. Thanks!

HansK · Answer

Thanks for your reply.
Your suggestions aren't passing syntax checks in the editor, so let me clarify:

My Trust policy contains this principal statement:
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam:::**root**"
			},
			etc...

You suggested using
			"Principal": {
				"AWS": arn:aws:iam:::**role/**
			},
			etc... 
Also, note, you're **not using quotation marks** for after the "AWS": portion, something the editor seems to require.
I tried changing from ...:root version to your suggested :role/ version, but the policy editor states that this is an invalid Principal statement. It wouldn't even update the policy.

The IAM **role ** has the tag key IsAppStudioDataAccessRole and its value is set to the string "true".

So, it appears your suggestion has two issues: 
(1) Quotations are needed after the "AWS": portion
(2) Replacing ":root" with ":role/" appears to be an invalid principal statement

Can you/anyone chime in here? I just can't figure out why my policy seems to fail.

HansK · Answer

The AI-generated answer suggests typos, exact tag names, etc. I double checked this and believe my policy is correct. Here it is (with acct name and Instant-ID removed). I don't see any error. Still, the Connector "Verify" check fails.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam:::root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalTag/IsAppStudioAccessRole": "true",
                    "sts:ExternalId": "<36_characters_here>"
                }
            }
        }
    ]
}

So, I still need help...

Taz · Answer

Hey,

Hope you're keeping well.

The “App Studio was not able to assume the IAM role” error occurs when the Connector setup cannot pass the AWS `sts:AssumeRole` call because the trust policy or required tag configuration is incomplete. For App Studio, the IAM role must have the tag key `IsAppStudioDataAccessRole` set to the string `"true"` and a trust policy that explicitly allows the **App Studio service principal** to assume it. The correct principal format is `arn:aws:iam:::role/` and must match exactly what is shown under **Settings → Instant ID** in the App Studio console.

Thanks and regards,  
Taz

re:Post Agent · Answer

Based on your description, it sounds like you're encountering a common issue with the trust policy configuration for App Studio connectors. Let me help you troubleshoot this.

When setting up the IAM role for your connector, there are a few critical elements that need to be correctly configured:

1. **Trust Policy Configuration**: The trust policy needs to include the correct AWS account ID in the Principal section. This should be the AWS account ID of the account used to set up App Studio, not necessarily the account where your resources are located.

2. **Required Tag Condition**: Your trust policy must include the condition `"aws:PrincipalTag/IsAppStudioAccessRole": "true"` in the `sts:AssumeRole` section. Note that this is different from the role tag you mentioned (`IsAppStudioDataAccessRole`).

3. **Role Tags**: The IAM role itself needs to have the tag `IsAppStudioDataAccessRole: true` (which you've already done correctly).

Here's what your trust policy should look like:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::YOUR_APP_STUDIO_ACCOUNT_ID:root" 
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"aws:PrincipalTag/IsAppStudioAccessRole": "true"
}
}
}
]
}
```

Double-check that:
- You're using the correct AWS account ID where App Studio is set up
- The condition is specifically for `IsAppStudioAccessRole` (not `IsAppStudioDataAccessRole`)
- The IAM role has the tag `IsAppStudioDataAccessRole: true`
- There are no typos or formatting issues in your trust policy

This custom trust policy is required even if your AWS resources are in the same AWS account used to set up App Studio.  
**Sources**  
[Troubleshooting connectors - AWS App Studio](https://docs.aws.amazon.com/appstudio/latest/userguide/troubleshooting-connectors.html)

Cannot set up Connector for App Studio

Add your answer

Relevant content