Hello there,
Since last few days we are getting following error for every table in Dremio when we execute the query first time. Strangely it works fine when executed again:
Credential verification failed. arn:aws:sts:::assumed-role/ServerlessDataAccessRole/eks-serverless-dremio-exe-81ee839b-642f-4f49-a653-ba44780c823b is not authorized to perform sts:TagSession on arn:aws:iam:::role/trg-am-dev-dremio-cross-account-role. Verify your AWS credentials and IAM permissions.
We are using our own AWS S3 storage. Trust was established between Dremio and AWS when project was created. We have two projects in Dremio so far and error is seen in both.
Has anyone else faced this and what can be the fix?
Our devOps team has verified policies on our end
The trust policy on the target cross-account role (in the S3 account we control) grants both sts:AssumeRole and sts:TagSession to the Dremio account root, in a single statement under one sts:ExternalId condition. Since both actions are evaluated together in the same STS call and AssumeRole clearly succeeds on retry with the same ExternalId, the condition isn’t gating TagSession differently. The target trust side appears correctly configured.
The failing identity (ServerlessDataAccessRole) is in Dremio’s own serverless account, which we don’t control, so we can’t inspect its identity policy.