AWS Batch创建计算环境失败：batch.amazonaws.com无sts:AssumeRole权限问题求助

Let's break down your issue and walk through targeted fixes, since you've already confirmed the basics like the role existing and having the right trust relationship.

First, let's anchor on the core error we need to resolve:

DELETING - CLIENT_ERROR - User: batch.amazonaws.com is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::402726478692:role/service-role/AWSBatchServiceRole

Even though you've added the correct managed policies and trust rules, here are the next critical things to check:

1. Double-Check for Hidden Conditional Restrictions in the Trust Relationship #

Your provided trust policy looks clean, but accidental edits or legacy template settings can sometimes add conditional statements (like aws:SourceArn or aws:SourceAccount) that block the Batch service from assuming the role.

To verify:

• Navigate to IAM → Roles → AWSBatchServiceRole → Trust relationships → Edit trust policy
• Ensure it only contains the statement you shared:

  { 
    "Version": "2012-10-17", 
    "Statement": [ 
      { 
        "Effect": "Allow", 
        "Principal": { "Service": "batch.amazonaws.com" }, 
        "Action": "sts:AssumeRole" 
      } 
    ] 
  }
  

• Remove any extra conditions if present, save the policy, and try redeploying your CloudFormation stack.

2. Check for IAM Permission Boundaries on the Role #

If the AWSBatchServiceRole has a permission boundary attached, it might be overriding the trust relationship and blocking the sts:AssumeRole action. Permission boundaries act as a hard cap on what a role can do, even if the trust policy allows access.

To inspect:

• Go to IAM → Roles → AWSBatchServiceRole → Permissions → Permission boundary
• If a boundary is listed, verify it explicitly allows sts:AssumeRole for the Batch service. For testing, you can temporarily remove the boundary to see if that resolves the error.

3. Inspect Service Control Policies (SCPs) (For AWS Organization Accounts) #

If your account is part of an AWS Organization, a Service Control Policy (SCP) at the root, OU, or account level might be restricting sts:AssumeRole actions for the Batch service. SCPs apply to all entities in the account, including AWS service principals.

To check:

• Navigate to AWS Organizations → Policies → Service control policies
• Look for any policies with Deny statements targeting sts:AssumeRole or restricting access to the AWSBatchServiceRole ARN
• Ensure there's an explicit Allow for batch.amazonaws.com to perform sts:AssumeRole on that role if needed.

4. Recreate the AWSBatchServiceRole (Troubleshooting Step) #

Sometimes the default Batch service role can get corrupted or have hidden configuration issues. Try deleting the existing role and letting AWS Batch recreate it correctly:

1. Delete the AWSBatchServiceRole from IAM (confirm no other resources are using it first)
2. Either:
   • Go to the AWS Batch console and create a compute environment manually—this triggers AWS to auto-create the correct service role, or
   • Manually recreate the role with:
     • The trust relationship you already have
     • The managed policy AWSBatchServiceRole (note: this is different from AWSBatchFullAccess—the service role policy is specifically designed for the Batch service itself)

5. Validate CloudFormation Execution Role Permissions #

While less likely, ensure the IAM role your CloudFormation stack uses (the execution role) has iam:PassRole permissions for the AWSBatchServiceRole ARN. This allows CloudFormation to pass the role to the Batch service during stack creation.

A quick note on your other roles: Your ECSRole and JobRole have overly broad permissions (like iam:* on an S3 resource, which doesn't make sense) — you should tighten those once you resolve the core compute environment issue, but they aren't related to this sts:AssumeRole error.

Start with the trust relationship and permission boundary checks, as those are the most common culprits for this specific error.

内容的提问来源于stack exchange，提问作者Xonshiz