A company has contracted with a third party to audit several AWS accounts.

The following may be causing the problem for the Auditor:

A. The external ID used by the Auditor is missing or incorrect. This is a possible cause, because the external ID is a unique identifier that is used to establish a trust relationship between the accounts.The external ID must match the one that is specified in the role’s trust policy in the destination account1.

C. The Auditor has not been granted sts:AssumeRole for the role in the destination account. This is a possible cause, because sts:AssumeRole is the API action that allows the Auditor to assume the cross-account role and obtain temporary credentials.The Auditor must have an IAM policy that allows them to call sts:AssumeRole for the role ARN in the destination account2.

F. The role ARN used by the Auditor is missing or incorrect. This is a possible cause, because the role ARN is the Amazon Resource Name of the cross-account role that the Auditor wants to assume.The role ARN must be valid and exist in the destination account3.