Question

A security engineer builds a cross-account automation tool that runs on an on-premises server. The tool calls sts:AssumeRole to obtain temporary credentials for a role in a target AWS account, then uses those credentials to call S3 APIs. Intermittently, calls fail with a SignatureDoesNotMatch error citing that the request timestamp is too far from the current time, and occasionally AssumeRole itself is rejected. The IAM policies and trust relationships have been verified as correct. What is the MOST likely root cause and the appropriate remediation?

Accepted Answer

The on-premises server's system clock has drifted; configure NTP time synchronization so request signatures fall within AWS's allowed timestamp tolerance.

Answer

The temporary credentials expired mid-session; increase the role's DurationSeconds to the maximum of 43200 seconds to avoid re-signing.

Answer

The role trust policy is missing an external ID; add an sts:ExternalId condition to prevent the confused deputy problem.

Answer

The requests are being throttled by STS; implement exponential backoff and request an STS rate-limit increase from AWS Support.