Qovery now sends your organization ID as the sts:ExternalId when it assumes the IAM role in your AWS account, and the role’s trust policy only accepts it on behalf of your organization. Your role is already updated. If you manage it with the qovery-role-creation CloudFormation stack, update the stack to the latest template.