AWS Security Agent — Code Review fails with "pentest is not authorized to assume service role

The error "pentest is not authorized to assume service role" during a code review suggests a mismatch in how the service role is configured.

Here's what's likely happening and how to fix it: **Root Cause: **The service role you're selecting during code review creation is the Penetration Test Service Role, which has a trust policy that requires an sts:ExternalId condition. When AWS Security Agent tries to assume this role for code review operations, it may be passing a different (or no) external ID, causing the assume-role to fail.

Things to check: 1. Trust policy - External ID mismatch: The Penetration Test Service Role trust policy likely includes a sts:ExternalId condition. The External ID used in the trust policy must exactly match the one AWS Security Agent passes. Check the trust policy on your auto-generated role and verify the External ID matches what your Agent Space expects. You can find the expected External ID in the Agent Space configuration in the console.

**2. Wrong role type selected: **Code review uses a service role with different permissions than pen testing. Per the quickstart docs, during code review setup (Step 2: Optional configurations), there's a "default service role pre-configured with the required permissions." Make sure you're selecting the correct service role during code review creation - not the penetration test role.

Service principal in trust policy: The trust policy must allow securityagent.amazonaws.com as the service principal:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "Service": "securityagent.amazonaws.com"
    },
    "Action": "sts:AssumeRole"
  }]
}

Custom roles not appearing: Custom IAM roles only show in the dropdown if they have the correct trust policy with securityagent.amazonaws.com as the principal. If your custom role doesn't appear, double-check the trust relationship is set correctly.

Recommended fix: Go to the Agent Space > Code review tab and re-run the setup wizard (Step 2: Optional configurations). Let it generate a fresh default service role for code review specifically, rather than reusing the pen test role. If you must use a custom role, ensure the trust policy has securityagent.amazonaws.com as principal without an External ID condition (code review may not pass one).

If you still run into an error, and want to pinpoint the exact denial, look up the AssumeRole event in CloudTrail and read the errorMessage, it'll tell you whether it's the trust policy or even an SCP blocking the call (if you are using AWS Org and SCP).