aws-amplify / aws-amplify/amplify-hosting

"Unable to assume IAM Role" but really issue is repo is private

Open
#4,035 5 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
Dockerfile
Stars
481
Forks
123
PR merge metrics
No merged PRs in 30d

Description

### Environment information

```plain text
N/A
```

### Describe the bug

I had made a repo private, but the Amplify GitHub app has full permissions to all the repos. However, when deploying the app I kept getting the error that it was unable to assume the IAM role during build. Only when I made the repo public again did the build succeed.

Error looks like this

```
2025-02-13T01:47:24.337Z [ERROR]: !!! Unable to assume specified IAM Role. Please ensure the selected IAM Role has sufficient permissions and the Trust Relationship is configured correctly.
```

Since error is seemingly related to IAM, I was delayed in deploying client site for over an hour with updates while trying to figure out IAM issues.

### Reproduction steps

1. Make GitHub repo private
2. Reconnect repository and ensure the Amplify app in GitHub has permission to all repos
3. Try to deploy the app and it will fail during build

Contributor guide

Open the contributing guide

Research direction

Start by reproducing deployment with a private GitHub repository after reconnecting the Amplify GitHub app, then inspect the deployment logs around the IAM role error. Trace the private-repository access and role-assumption path to determine why the failure is reported as an IAM problem. Done means the diagnostic identifies the repository-access issue accurately and the private-repository deployment succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, github
Domain
authorization, ci-cd, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.