Error configuring the backend "s3": The role "arn:aws:iam::##REPLACED_AWS_ACCOUNT_ID##:role/Terragrunt" cannot be assumed.

sts-assume.log

ms at ms in ~/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc (add-terraform-template●●)
$ TF_LOG=trace AWS_PROFILE=sb-dev@ms terragrunt plan  --terragrunt-iam-role arn:aws:iam::##REPLACED_AWS_ACCOUNT_ID##:role/Terragrunt  >> assume.log
[terragrunt] [/Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc] 2019/02/04 12:47:39 Running command: terraform --version
[terragrunt] 2019/02/04 12:47:39 Reading Terragrunt config file at /Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc/terraform.tfvars
[terragrunt] 2019/02/04 12:47:41 Assuming IAM role arn:aws:iam::##REPLACED_AWS_ACCOUNT_ID##:role/Terragrunt
[terragrunt] 2019/02/04 12:47:41 WARNING: no double-slash (//) found in source URL /terraform-aws-modules/terraform-aws-vpc.git. Relative paths in downloaded Terraform code may not work.
[terragrunt] 2019/02/04 12:47:41 Terraform files in /Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc/.terragrunt-cache/Ppuu66FakoePrWi7w1iP2twnLIQ/A35GeYiqYDYXDWZftKtd1kkU5ic are up to date. Will not download again.
[terragrunt] 2019/02/04 12:47:41 Copying files from /Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc into /Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc/.terragrunt-cache/Ppuu66FakoePrWi7w1iP2twnLIQ/A35GeYiqYDYXDWZftKtd1kkU5ic
[terragrunt] 2019/02/04 12:47:41 Setting working directory to /Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc/.terragrunt-cache/Ppuu66FakoePrWi7w1iP2twnLIQ/A35GeYiqYDYXDWZftKtd1kkU5ic
[terragrunt] 2019/02/04 12:47:41 Backend config has changed from map[dynamodb_table:sb-dev-terragrunt-state-lock-##REPLACED_AWS_ACCOUNT_ID## encrypt:%!s(bool=true) key:ap-southeast-1/dev/vpc/terraform.tfstate profile:sb-dev@ms region:ap-southeast-1 role_arn:arn:aws:iam::##REPLACED_AWS_ACCOUNT_ID##:role/Terragrunt bucket:sb-dev-terragrunt-state-##REPLACED_AWS_ACCOUNT_ID##] to map[encrypt:%!s(bool=true) bucket:sb-dev-terragrunt-state-##REPLACED_AWS_ACCOUNT_ID## key:ap-southeast-1/dev/vpc/terraform.tfstate region:ap-southeast-1 dynamodb_table:sb-dev-terragrunt-state-lock-##REPLACED_AWS_ACCOUNT_ID##]
[terragrunt] [/Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc] 2019/02/04 12:47:41 Backend config has changed from map[bucket:sb-dev-terragrunt-state-##REPLACED_AWS_ACCOUNT_ID## dynamodb_table:sb-dev-terragrunt-state-lock-##REPLACED_AWS_ACCOUNT_ID## encrypt:%!s(bool=true) key:ap-southeast-1/dev/vpc/terraform.tfstate profile:sb-dev@ms region:ap-southeast-1 role_arn:arn:aws:iam::##REPLACED_AWS_ACCOUNT_ID##:role/Terragrunt] to map[dynamodb_table:sb-dev-terragrunt-state-lock-##REPLACED_AWS_ACCOUNT_ID## encrypt:%!s(bool=true) bucket:sb-dev-terragrunt-state-##REPLACED_AWS_ACCOUNT_ID## key:ap-southeast-1/dev/vpc/terraform.tfstate region:ap-southeast-1]
[terragrunt] [/Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc] 2019/02/04 12:47:41 Initializing remote state for the s3 backend
[terragrunt] [/Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc] 2019/02/04 12:47:42 Running command: terraform init -backend-config=encrypt=true -backend-config=bucket=sb-dev-terragrunt-state-##REPLACED_AWS_ACCOUNT_ID## -backend-config=key=ap-southeast-1/dev/vpc/terraform.tfstate -backend-config=region=ap-southeast-1 -backend-config=dynamodb_table=sb-dev-terragrunt-state-lock-##REPLACED_AWS_ACCOUNT_ID##
2019/02/04 12:47:42 [INFO] Terraform version: 0.11.11
2019/02/04 12:47:42 [INFO] Go runtime version: go1.11.4
2019/02/04 12:47:42 [INFO] CLI args: []string{"/usr/local/Cellar/terraform/0.11.11/bin/terraform", "init", "-backend-config=encrypt=true", "-backend-config=bucket=sb-dev-terragrunt-state-##REPLACED_AWS_ACCOUNT_ID##", "-backend-config=key=ap-southeast-1/dev/vpc/terraform.tfstate", "-backend-config=region=ap-southeast-1", "-backend-config=dynamodb_table=sb-dev-terragrunt-state-lock-##REPLACED_AWS_ACCOUNT_ID##"}
2019/02/04 12:47:42 [DEBUG] Attempting to open CLI config file: /Users/ms/.terraformrc
2019/02/04 12:47:42 [DEBUG] File doesn't exist, but doesn't need to. Ignoring.
2019/02/04 12:47:42 [INFO] CLI command args: []string{"init", "-backend-config=encrypt=true", "-backend-config=bucket=sb-dev-terragrunt-state-##REPLACED_AWS_ACCOUNT_ID##", "-backend-config=key=ap-southeast-1/dev/vpc/terraform.tfstate", "-backend-config=region=ap-southeast-1", "-backend-config=dynamodb_table=sb-dev-terragrunt-state-lock-##REPLACED_AWS_ACCOUNT_ID##"}
2019/02/04 12:47:42 [DEBUG] command: loading backend config file: /Users/ms/Documents/src/bitbucket/sb/sb/sb-mono/infra/live/accounts/sb-dev/ap-southeast-1/dev/vpc/.terragrunt-cache/Ppuu66FakoePrWi7w1iP2twnLIQ/A35GeYiqYDYXDWZftKtd1kkU5ic

2019/02/04 12:47:42 [DEBUG] command: adding extra backend config from CLI
Initializing the backend...
2019/02/04 12:47:42 [TRACE] Preserving existing state lineage "8b9b95b0-d6e4-af6e-7c53-14748b4b9022"
2019/02/04 12:47:42 [TRACE] Preserving existing state lineage "8b9b95b0-d6e4-af6e-7c53-14748b4b9022"
2019/02/04 12:47:42 [WARN] command: backend config change! saved: 9345827190033900985, new: 17249428079896225169
Backend configuration changed!

Terraform has detected that the configuration specified for the backend
has changed. Terraform will now check for existing state in the backends.

2019/02/04 12:47:42 [INFO] Building AWS region structure
2019/02/04 12:47:42 [INFO] Building AWS auth structure

2019/02/04 12:47:42 [INFO] Setting AWS metadata API timeout to 100ms
2019/02/04 12:47:43 [INFO] Ignoring AWS metadata API endpoint at default location as it doesn't return any instance-id
2019/02/04 12:47:43 [INFO] AWS Auth provider used: "EnvProvider"
2019/02/04 12:47:43 [INFO] Initializing DeviceFarm SDK connection
2019/02/04 12:47:43 [DEBUG] [aws-sdk-go] DEBUG: Request sts/GetCallerIdentity Details:
---[ REQUEST POST-SIGN ]-----------------------------
POST / HTTP/1.1
Host: sts.amazonaws.com
User-Agent: aws-sdk-go/1.14.31 (go1.11.4; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.11.11
Content-Length: 43
Authorization: AWS4-HMAC-SHA256 Credential=ASIAVV5NFYZTES7QOSPW/20190204/us-east-1/sts/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token, Signature=0c612b0d55a1b29d0ef47f9c6b2f3523816e0b15e2d98cd951e1342aacadb2ca
Content-Type: application/x-www-form-urlencoded; charset=utf-8
X-Amz-Date: 20190204T044743Z
X-Amz-Security-Token: FQoGZXIvYXdzEJ7//////////wEaDFyyqy+l9ovZWrcJnCKCAiR095VHi2Plu6lGzY590IimYj8FIqB9pf3i9fyUgXVptj4oTFci8aUPlZy2jLPqQ18lGbdSCE1PNbHWrl1lvIHIQnbox106Z5ezceU+fGazACEKnuSrjtTbzFUpHrY1Lr9/EOUyP8L6Fs37CRr3xuqI6E9eFIarYa2uHTF898GkpDl1c+2Pn8uC/JFWrAVsy0/mFGcjXMs4v0ZuRo+vHL+WXw58GrVRvX6SkNN/wmYFlpiST/JGl6FutyV7piebcezpeQULKGLbNCLFS1E/YQroisSlN0JMVcjO+TiiBPLJG3+1uvY7kXH6EoTNlVNCBqL37yuDeKRgNkq7/lzIzVZheijuh9/iBQ==
Accept-Encoding: gzip

Action=GetCallerIdentity&Version=2011-06-15
-----------------------------------------------------
2019/02/04 12:47:44 [DEBUG] [aws-sdk-go] DEBUG: Response sts/GetCallerIdentity Details:
---[ RESPONSE ]--------------------------------------
HTTP/1.1 200 OK
Connection: close
Content-Length: 477
Content-Type: text/xml
Date: Mon, 04 Feb 2019 04:47:44 GMT
X-Amzn-Requestid: 03050189-2838-11e9-a515-133de42d473a


-----------------------------------------------------
2019/02/04 12:47:44 [DEBUG] [aws-sdk-go] <GetCallerIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <GetCallerIdentityResult>
    <Arn>arn:aws:sts::##REPLACED_AWS_ACCOUNT_ID##:assumed-role/Terragrunt/terragrunt-1549255661594111000</Arn>
    <UserId>AROAJ77T74QAWLG6RQRDS:terragrunt-1549255661594111000</UserId>
    <Account>##REPLACED_AWS_ACCOUNT_ID##</Account>
  </GetCallerIdentityResult>
  <ResponseMetadata>
    <RequestId>03050189-2838-11e9-a515-133de42d473a</RequestId>
  </ResponseMetadata>
</GetCallerIdentityResponse>
2019/02/04 12:47:44 [DEBUG] Trying to get account ID via iam:GetUser
2019/02/04 12:47:44 [DEBUG] [aws-sdk-go] DEBUG: Request iam/GetUser Details:
---[ REQUEST POST-SIGN ]-----------------------------
POST / HTTP/1.1
Host: iam.amazonaws.com
User-Agent: aws-sdk-go/1.14.31 (go1.11.4; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.11.11
Content-Length: 33
Authorization: AWS4-HMAC-SHA256 Credential=ASIAVV5NFYZTES7QOSPW/20190204/us-east-1/iam/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token, Signature=64bcb950b340c52d332e4f706131074290fcc091ff0de476aa56ce4b8b94aa24
Content-Type: application/x-www-form-urlencoded; charset=utf-8
X-Amz-Date: 20190204T044744Z
X-Amz-Security-Token: FQoGZXIvYXdzEJ7//////////wEaDFyyqy+l9ovZWrcJnCKCAiR095VHi2Plu6lGzY590IimYj8FIqB9pf3i9fyUgXVptj4oTFci8aUPlZy2jLPqQ18lGbdSCE1PNbHWrl1lvIHIQnbox106Z5ezceU+fGazACEKnuSrjtTbzFUpHrY1Lr9/EOUyP8L6Fs37CRr3xuqI6E9eFIarYa2uHTF898GkpDl1c+2Pn8uC/JFWrAVsy0/mFGcjXMs4v0ZuRo+vHL+WXw58GrVRvX6SkNN/wmYFlpiST/JGl6FutyV7piebcezpeQULKGLbNCLFS1E/YQroisSlN0JMVcjO+TiiBPLJG3+1uvY7kXH6EoTNlVNCBqL37yuDeKRgNkq7/lzIzVZheijuh9/iBQ==
Accept-Encoding: gzip

Action=GetUser&Version=2010-05-08
-----------------------------------------------------
2019/02/04 12:47:45 [DEBUG] [aws-sdk-go] DEBUG: Response iam/GetUser Details:
---[ RESPONSE ]--------------------------------------
HTTP/1.1 403 Forbidden
Connection: close
Content-Length: 421
Content-Type: text/xml
Date: Mon, 04 Feb 2019 04:47:45 GMT
X-Amzn-Requestid: 03ae1336-2838-11e9-863e-3ddf5b7b5e35


-----------------------------------------------------
2019/02/04 12:47:45 [DEBUG] [aws-sdk-go] <ErrorResponse xmlns="https://iam.amazonaws.com/doc/2010-05-08/">
  <Error>
    <Type>Sender</Type>
    <Code>AccessDenied</Code>
    <Message>User: arn:aws:sts::##REPLACED_AWS_ACCOUNT_ID##:assumed-role/Terragrunt/terragrunt-1549255661594111000 is not authorized to perform: iam:GetUser on resource: user terragrunt-1549255661594111000</Message>
  </Error>
  <RequestId>03ae1336-2838-11e9-863e-3ddf5b7b5e35</RequestId>
</ErrorResponse>
2019/02/04 12:47:45 [DEBUG] [aws-sdk-go] DEBUG: Validate Response iam/GetUser failed, not retrying, error AccessDenied: User: arn:aws:sts::##REPLACED_AWS_ACCOUNT_ID##:assumed-role/Terragrunt/terragrunt-1549255661594111000 is not authorized to perform: iam:GetUser on resource: user terragrunt-1549255661594111000
	status code: 403, request id: 03ae1336-2838-11e9-863e-3ddf5b7b5e35
2019/02/04 12:47:45 [DEBUG] Getting account ID via iam:GetUser failed: AccessDenied: User: arn:aws:sts::##REPLACED_AWS_ACCOUNT_ID##:assumed-role/Terragrunt/terragrunt-1549255661594111000 is not authorized to perform: iam:GetUser on resource: user terragrunt-1549255661594111000
	status code: 403, request id: 03ae1336-2838-11e9-863e-3ddf5b7b5e35
2019/02/04 12:47:45 [DEBUG] Trying to get account ID via sts:GetCallerIdentity
2019/02/04 12:47:45 [DEBUG] [aws-sdk-go] DEBUG: Request sts/GetCallerIdentity Details:
---[ REQUEST POST-SIGN ]-----------------------------
POST / HTTP/1.1
Host: sts.amazonaws.com
User-Agent: aws-sdk-go/1.14.31 (go1.11.4; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.11.11
Content-Length: 43
Authorization: AWS4-HMAC-SHA256 Credential=ASIAVV5NFYZTES7QOSPW/20190204/us-east-1/sts/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token, Signature=7a635dbb51b83397b9fbfce51e9c4618942c5919958954ce2eaa8e9700678a3a
Content-Type: application/x-www-form-urlencoded; charset=utf-8
X-Amz-Date: 20190204T044745Z
X-Amz-Security-Token: FQoGZXIvYXdzEJ7//////////wEaDFyyqy+l9ovZWrcJnCKCAiR095VHi2Plu6lGzY590IimYj8FIqB9pf3i9fyUgXVptj4oTFci8aUPlZy2jLPqQ18lGbdSCE1PNbHWrl1lvIHIQnbox106Z5ezceU+fGazACEKnuSrjtTbzFUpHrY1Lr9/EOUyP8L6Fs37CRr3xuqI6E9eFIarYa2uHTF898GkpDl1c+2Pn8uC/JFWrAVsy0/mFGcjXMs4v0ZuRo+vHL+WXw58GrVRvX6SkNN/wmYFlpiST/JGl6FutyV7piebcezpeQULKGLbNCLFS1E/YQroisSlN0JMVcjO+TiiBPLJG3+1uvY7kXH6EoTNlVNCBqL37yuDeKRgNkq7/lzIzVZheijuh9/iBQ==
Accept-Encoding: gzip

Action=GetCallerIdentity&Version=2011-06-15
-----------------------------------------------------
2019/02/04 12:47:46 [DEBUG] [aws-sdk-go] DEBUG: Response sts/GetCallerIdentity Details:
---[ RESPONSE ]--------------------------------------
HTTP/1.1 200 OK
Connection: close
Content-Length: 477
Content-Type: text/xml
Date: Mon, 04 Feb 2019 04:47:46 GMT
X-Amzn-Requestid: 043dd01a-2838-11e9-a364-c52a6dd04675


-----------------------------------------------------
2019/02/04 12:47:46 [DEBUG] [aws-sdk-go] <GetCallerIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <GetCallerIdentityResult>
    <Arn>arn:aws:sts::##REPLACED_AWS_ACCOUNT_ID##:assumed-role/Terragrunt/terragrunt-1549255661594111000</Arn>
    <UserId>AROAJ77T74QAWLG6RQRDS:terragrunt-1549255661594111000</UserId>
    <Account>##REPLACED_AWS_ACCOUNT_ID##</Account>
  </GetCallerIdentityResult>
  <ResponseMetadata>
    <RequestId>043dd01a-2838-11e9-a364-c52a6dd04675</RequestId>
  </ResponseMetadata>
</GetCallerIdentityResponse>
2019/02/04 12:47:46 [DEBUG] [aws-sdk-go] DEBUG: Request ec2/DescribeAccountAttributes Details:
---[ REQUEST POST-SIGN ]-----------------------------
POST / HTTP/1.1
Host: ec2.ap-southeast-1.amazonaws.com
User-Agent: aws-sdk-go/1.14.31 (go1.11.4; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.11.11
Content-Length: 87
Authorization: AWS4-HMAC-SHA256 Credential=ASIAVV5NFYZTES7QOSPW/20190204/ap-southeast-1/ec2/aws4_request, SignedHeaders=content-length;content-type;host;x-amz-date;x-amz-security-token, Signature=cc4dce722d39bfb003952655609961aba66fe3a9c3cbd1dbd8357eb85fc65f0b
Content-Type: application/x-www-form-urlencoded; charset=utf-8
X-Amz-Date: 20190204T044746Z
X-Amz-Security-Token: FQoGZXIvYXdzEJ7//////////wEaDFyyqy+l9ovZWrcJnCKCAiR095VHi2Plu6lGzY590IimYj8FIqB9pf3i9fyUgXVptj4oTFci8aUPlZy2jLPqQ18lGbdSCE1PNbHWrl1lvIHIQnbox106Z5ezceU+fGazACEKnuSrjtTbzFUpHrY1Lr9/EOUyP8L6Fs37CRr3xuqI6E9eFIarYa2uHTF898GkpDl1c+2Pn8uC/JFWrAVsy0/mFGcjXMs4v0ZuRo+vHL+WXw58GrVRvX6SkNN/wmYFlpiST/JGl6FutyV7piebcezpeQULKGLbNCLFS1E/YQroisSlN0JMVcjO+TiiBPLJG3+1uvY7kXH6EoTNlVNCBqL37yuDeKRgNkq7/lzIzVZheijuh9/iBQ==
Accept-Encoding: gzip

Action=DescribeAccountAttributes&AttributeName.1=supported-platforms&Version=2016-11-15
-----------------------------------------------------
2019/02/04 12:47:46 [DEBUG] [aws-sdk-go] DEBUG: Response ec2/DescribeAccountAttributes Details:
---[ RESPONSE ]--------------------------------------
HTTP/1.1 200 OK
Connection: close
Content-Length: 540
Content-Type: text/xml;charset=UTF-8
Date: Mon, 04 Feb 2019 04:47:46 GMT
Server: AmazonEC2


-----------------------------------------------------
2019/02/04 12:47:46 [DEBUG] [aws-sdk-go] <?xml version="1.0" encoding="UTF-8"?>
<DescribeAccountAttributesResponse xmlns="http://ec2.amazonaws.com/doc/2016-11-15/">
    <requestId>2e5da5c7-4d04-450d-89e1-1e4092690dd4</requestId>
    <accountAttributeSet>
        <item>
            <attributeName>supported-platforms</attributeName>
            <attributeValueSet>
                <item>
                    <attributeValue>VPC</attributeValue>
                </item>
            </attributeValueSet>
        </item>
    </accountAttributeSet>
</DescribeAccountAttributesResponse>
2019/02/04 12:47:46 [INFO] Building AWS region structure
2019/02/04 12:47:46 [INFO] Building AWS auth structure
2019/02/04 12:47:46 [INFO] Setting AWS metadata API timeout to 100ms
2019/02/04 12:47:47 [INFO] Ignoring AWS metadata API endpoint at default location as it doesn't return any instance-id
2019/02/04 12:47:47 [INFO] Attempting to AssumeRole arn:aws:iam::##REPLACED_AWS_ACCOUNT_ID##:role/Terragrunt (SessionName: "", ExternalId: "", Policy: "")
2019/02/04 12:47:47 [INFO] AWS Auth provider used: "EnvProvider"
2019/02/04 12:47:48 [DEBUG] plugin: waiting for all plugin processes to complete...
Error loading previously configured backend:
Error configuring the backend "s3": The role "arn:aws:iam::##REPLACED_AWS_ACCOUNT_ID##:role/Terragrunt" cannot be assumed.

  There are a number of possible causes of this - the most common are:
    * The credentials used in order to assume the role are invalid
    * The credentials do not have appropriate permission to assume the role
    * The role ARN is not valid

Please update the configuration in your Terraform files to fix this error.
If you'd like to update the configuration interactively without storing
the values in your configuration, run "terraform init".

[terragrunt] 2019/02/04 12:47:48 Hit multiple errors:
exit status 1