Assuming a role using in Talend Route when establishing connection with AWS

tejib — Mon, 16 Mar 2026 08:03:47 GMT

I am trying to build a route that consumes messages from an AWS SQS queue. To do this, the underlying instance needs to assume an IAM role that has permissions to access the SQS queue. However, the default instance profile does not have access to this queue.

When I review the cAWSConnection component, I do not see any option to specify a role ARN to assume. Similarly, the cAWSSQS component does not provide a way to supply a role ARN directly; instead, it only allows referencing an AWS connection component. The documentation I reviewed is here:
https://help.qlik.com/talend/en-US/mediation-components/8.0/mediation-amazon-sqs/amazon-sqs-component

The ability to explicitly assume a role using a role ARN does exist in the standard components—for example, the standard SQS connection:
https://help.qlik.com/talend/en-US/components/7.3/amazon-sqs/tsqsconnection-standard-properties
and the standard S3 connection:
https://help.qlik.com/talend/en-US/components/7.3/amazon-s3/ts3connection-standard-properties

However, this capability appears to be missing from cAWSConnection when used in a Route.

Since I cannot use static access keys (access key/secret key), and the default instance profile cannot be granted direct access to the SQS queue, could someone please advise how to explicitly assume an IAM role using its ARN when creating a Route?

Re: Assuming a role using in Talend Route when establishing connection with AWS

David_Apodaca — Sat, 04 Apr 2026 01:02:59 GMT

Hi Folks,

You are correct in your observations between the route components and the standard components. The ability to explicitly assume an IAM role (via Role ARN) is available in standard Talend components such as tSQSConnection, but this capability is not exposed in the mediation (Route) components like cAWSConnection.

This is due to an architectural difference: Route components are based on Apache Camel and rely on the AWS SDK’s default credential provider chain rather than exposing all authentication options directly in the component configuration. Route components are wrappers for Apache Camel, which prioritizes the AWS Default Credentials Provider Chain.

As a result, role assumption is still possible, but it must be configured outside of the component itself.

The recommended approach is to configure role assumption at the environment level so that the AWS SDK used by the Route can pick it up automatically.

If you require explicit control of role assumption within the job design itself, an alternative would be to use standard Talend Job components (such as tSQSConnection) instead of a Route. However, this would involve a change in design approach.

You can find the standard components for standard SQS and S3 connections below.

tSQSConnection:
https://help.qlik.com/talend/en-US/components/8.0/amazon-sqs/tsqsconnection

tS3Connection:
https://help.qlik.com/talend/en-US/components/8.0/amazon-s3/ts3connection

Respectfully,
Qlik Support

topic Re: Assuming a role using in Talend Route when establishing connection with AWS in Talend Studio

Assuming a role using in Talend Route when establishing connection with AWS

Re: Assuming a role using in Talend Route when establishing connection with AWS