...
This is a known limitation of the AWS Security Token Service (STS) API, which only supports using AWS Identity and Access Management (IAM) API operations when using temporary credentials returned by the AssumeRole API action, but not for temporary credentials returned by by GetFederationToken or or GetSessionToken (except when using MFA), see Comparing the STS API Operations for details. Accordingly, you need to configure an Identity Federation for AWS connector with the principal type Assumed Role when a CloudFormation template contains IAM resources.
...