If you are unsure, ask your AWS administrator about SCPs. If both your policy and trust relationship appear to be correct, also check the following:Ĭonfirm that you include the correct role ARN in the credentials object.Ĭonfirm whether you have organization-level service control policies (SCPs) that deny the AssumeRole action or deny EC2/VPC access. Verify that the trust relationship of your customer role is set up properly according to instructions in the article Create a cross-account IAM role. If the credential configuration validation fails ten or more checks, it’s more likely that the trust relationship of the IAM role is incorrectly set up. Copy the correct policy from the article Create a cross-account IAM role. If the credential configuration validation fails fewer than ten permission checks, it’s likely that your IAM policy is missing those specific permissions.

The list of permissions checks in the error message indicate the likely cause of your problems. Malformed request: Failed credential configuration validation checks Databricks access to customer workspaces.Configure S3 access with instance profiles.Manage users, service principals, and groups.Automate workspace creation using templates.Create a workspace using the Account API.Create a workspace using the account console.Get started with Databricks administration.

Aws waf doc