Ravi Sir's Cards › AWS
AssumeRole AccessDenied but policy looks fine?
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
What it is
Check the role trust policy Principal and Conditions first. Permissions policy is evaluated after a successful assume.
trust policy
Why it matters
Also confirm your caller identity is allowed sts:AssumeRole and that ExternalId/MFA conditions match what you pass on the CLI.
How / example
Fix Principal to your user/role ARN, retry assume-role, then test S3 with the session token.