Databricks Free Edition: AWS S3 Unity Catalog Storage Credential Fails AssumeRole Validation

[ifra_inam]

I'm using Databricks Free Edition and trying to configure an AWS S3 external location through Unity Catalog.

My storage credential validation consistently fails at Assume Role, while Self Assume Role and External ID Condition are skipped.

Error: 

Failed - Assume Role
Skipped - Self Assume Role
Skipped - External ID Condition

Missing Permissions
PERMISSION_DENIED: Failed to get credentials: the AWS IAM role in the Unity Catalog credential is not configured correctly. Please contact your metastore admin or the credential owner to update the configuration in AWS.

I've verified:

- The IAM role ARN matches the Databricks storage credential.
- The Unity Catalog IAM principal matches the trust policy.
- The external ID matches exactly.
- The trust policy includes both the Databricks principal and self-assumption.
- The S3 permissions policy is attached.
- No permissions boundary is configured.

I've also retrieved the credential details using the Databricks SDK, which confirms all three values match.

Could someone help investigate why the initial cross-account `sts:AssumeRole` request is being rejected? Is there an additional configuration or workspace-specific issue that could cause this?

Thank you!

[nikhilmohod-nm]

Hi @ifra_inam 

I don't think this is a problem with your setup. You've checked everything that normally causes this error, and the way the validation fails points to Free Edition itself.

Assume Role is the first check that runs, and if it fails the other two are skipped automatically. That's why you see "Skipped" for them. The Free Edition limitations page also says custom storage locations aren't supported. Two other people posted the same error on Free Edition this week, so you're not the only one.

To confirm, look in CloudTrail for AssumeRole events on your role, and check across all regions. If nothing shows up, the request never reached your AWS account, so it's a platform limit and not your IAM config.

If you really need S3 external locations, try the same role on a Databricks free trial on AWS. Just update the External ID in the trust policy. If it validates there, that confirms it. For now, Unity Catalog Volumes are the easiest way to work with your files on Free Edition.

Hope this helps.

[Aravind_Reddy]

Hello @ifra_inam 

Since your IAM role, external ID, self-assumption and S3 permissions appear to be configured correctly, I would investigate the STS AssumeRole request itself before changing the S3 bucket policies.

A few additional checks could help narrow this down:

1. Check CloudTrail in the correct AWS region

Your Databricks workspace and metastore are in us-east-2. Check CloudTrail Event History in us-east-2 for AssumeRole events around the exact time you run the storage credential validation.

Look for:

• Event name: AssumeRole

• Event source: sts.amazonaws.com

• Error code and error message, if the request failed

If you find an event, the error details should help identify whether the issue is an invalid principal, external ID mismatch, or another STS authorization problem.

2. Verify the actual credential configuration

Use the Databricks SDK to retrieve the values configured in Unity Catalog and compare them against the AWS trust policy:

from databricks.sdk import WorkspaceClient

w = WorkspaceClient()
name = "your_credential_name"

credential = w.storage_credentials.get(name)
role = credential.aws_iam_role

print("Role ARN:", role.role_arn)
print("UC IAM ARN:", role.unity_catalog_iam_arn)
print("External ID:", role.external_id)

results = w.storage_credentials.validate(
    storage_credential_name=name
)

for result in results.results:
    print(result.operation, result.result, result.message)

Pay particular attention to the individual validation messages rather than only the overall validation status.

3. Verify the IAM trust policy

Confirm that the trust relationship contains:

• The Unity Catalog IAM principal returned by Databricks.

• The IAM role itself for self-assumption.

• The exact external ID associated with the storage credential.

• sts:AssumeRole as the allowed action.

Also ensure that the external ID condition and both principals are configured correctly in the trust policy.

4. Isolate a possible Free Edition limitation

If the trust policy and STS configuration are correct but no corresponding AssumeRole request reaches AWS, try creating the same storage credential using the same IAM role in a Databricks AWS trial workspace, if available.

If validation succeeds there but consistently fails in Free Edition, that would provide useful evidence of a Free Edition-specific limitation or issue. It would be worth reporting this to Databricks through the Free Edition feedback channel.

I wouldn't recommend changing S3 bucket permissions or making the bucket public at this stage, because the failure occurs before Databricks obtains the AWS role credentials.

Could you check CloudTrail specifically in us-east-2 and share the AssumeRole error details, if present? That would help identify whether this is an AWS trust-policy issue or something specific to the Free Edition environment.

[ShamenParis]

Hi @ifra_inam ,

The PERMISSION_DENIED failure at the very first Assume Role stage means AWS IAM is instantly rejecting the cross-account trust handshake. Because the failure happens immediately, Databricks never even reaches the S3 permissions check.

Critical limitation check: Databricks Free Edition does not support Unity Catalog external locations. It operates in a locked-down, Databricks-owned AWS environment. If you are using Free Edition, this configuration will always fail. If you are using a standard 14-day Free Trial deployed in your own AWS account, proceed with isolating the IAM rejection.