Cursor AWS Sts:AssumeRole not working for cloud agents

[gdemesa (Gabe De Mesa)]

Where does the bug appear (feature/product)?

Somewhere else…

Describe the Bug

When inside the cursor cloud agent, it does not inject the credentials-process.json so I can’t sts:AssumeRole for AWS.

Steps to Reproduce

I followed the steps here: Cloud Environment Setup | Cursor Docs

When I asked Cursor to assume a role I setup it said it doesn’t have /opt/cursor/.exec-daemon/aws/credentials-process.json so it doesn’t have initial AWS credentials as described in the documentation

Expected Behavior

The cursor cloud agent should be able to assume the role I setup correctly via the trust policy as described in the docs

Screenshots / Screen Recordings

Operating System

Linux

Version Information

Using cursor cloud agent

For AI issues: which model did you use?

gpt5.5

For AI issues: add Request ID with privacy disabled

bc-619ac4e1-02c2-4d94-8605-15d8f892f80a

Does this stop you from using Cursor

No - Cursor works, but with this issue

[Colin]

Hi @gdemesa,

This looks like an IAM trust policy misconfiguration rather than a Cursor issue. Cursor is successfully loading the AWS IAM role refresh configuration and initiating the STS AssumeRole call. It’s AWS that’s rejecting the request with an authorization error:

Failed to refresh AWS IAM credential_process payload | error.message: User: arn:aws:sts::289469326074:assumed-role/roleAssumer/cross-account-role-session is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::214286935198:role/ai-agent-cloud-agent

Since this rejection originates from AWS (not Cursor), you’ll likely need to update the trust policy on the target role (ai-agent-cloud-agent) to allow roleAssumer to assume it via sts:AssumeRole.

[gdemesa (Gabe De Mesa)]

Hey @Colin thanks for the quick reply. The trust policy I have added on our end is

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::289469326074:role/roleAssumer"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "2624093"
                }
            }
        }
    ]
}

I have sneaking suspicion the external id format is incorrect? For reference, attached is the screenshot of our team ID I am try to allow trust for.

For reference, I am following the documentation here: Cloud Environment Setup | Cursor Docs

Additionally, I set the runtime team secret for the cursor agentCURSOR_AWS_ASSUME_IAM_ROLE_ARN=arn:aws:iam::214286935198:role/ai-agent-cloud-agent

[Colin]

The docs say:

3. Generate an external ID: Navigate to Cursor Dashboard → Settings and find the External ID settings. If you don’t see an external ID displayed, enter a placeholder value in the “AWS IAM Role ARN” field, click “Validate & Save”, and reload the page. This will generate an external ID for your team (e.g. cursor-xxx-yyy-zzz).

So definitely don’t use your Team ID!

You’ll need a Team Admin to visit the Advanced section of your team settings.

It’s not super clear that a Team Admin needs to do this. I’ll get the docs updated.