Adding a secondary service account (IRSA) to trust relationship role I have a pretty standard trust relationship for a role defined (and is working) as such: