From 378ba01fd5e38841e8afe4050d309803fe85f85a Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Fri, 3 Jul 2026 15:23:30 +1000
Subject: [PATCH] fix: update STS e2e assertion for unconditional AccessDenied
 masking on missing roles

---
 tests/e2e/iam/sts_test.go | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/e2e/iam/sts_test.go b/tests/e2e/iam/sts_test.go
index 9f4fa3774..648216b4d 100644
--- a/tests/e2e/iam/sts_test.go
+++ b/tests/e2e/iam/sts_test.go
@@ -439,11 +439,11 @@ func runSTS(t *testing.T, fix *Fixture) {
 		return e
 	})
 
-	// Same-account miss → NoSuchEntity. Cross-account miss is masked to
-	// AccessDenied by the handler; that's covered by handlers/sts unit tests
-	// since the single-node fixture only has one account.
-	harness.Step(t, "assume-role missing role (expect NoSuchEntity)")
-	harness.ExpectError(t, "NoSuchEntity", func() error {
+	// All missing-role lookups are masked to AccessDenied by the handler,
+	// matching AWS and preventing role enumeration; same- vs cross-account
+	// masking is covered by handlers/sts unit tests.
+	harness.Step(t, "assume-role missing role (expect AccessDenied)")
+	harness.ExpectError(t, "AccessDenied", func() error {
 		_, e := fix.AWS.STS.AssumeRole(&sts.AssumeRoleInput{
 			RoleArn: aws.String(harness.IAMRoleARN(adminAccount,
 				"sts-e2e-no-such-role")),