diff --git a/.changeset/olive-geese-chew.md b/.changeset/olive-geese-chew.md
new file mode 100644
index 0000000000..a08b73b4a7
--- /dev/null
+++ b/.changeset/olive-geese-chew.md
@@ -0,0 +1,10 @@
+---
+'@backstage/backend-common': patch
+'@backstage/integration': patch
+---
+
+Support external ID when assuming roles in S3 integration
+
+In order to assume a role created by a 3rd party as external
+ID is needed. This change adds an optional field to the s3
+integration configuration and consumes that in the AwsS3UrlReader.
diff --git a/docs/integrations/aws-s3/locations.md b/docs/integrations/aws-s3/locations.md
index b0c6829e2c..9bac28f906 100644
--- a/docs/integrations/aws-s3/locations.md
+++ b/docs/integrations/aws-s3/locations.md
@@ -37,6 +37,7 @@ integrations:
     - accessKeyId: ${AWS_ACCESS_KEY_ID}
       secretAccessKey: ${AWS_SECRET_ACCESS_KEY}
       roleArn: 'arn:aws:iam::xxxxxxxxxxxx:role/example-role'
+      externalId: 'some-id' # optional
 ```
 
 Configuration allows specifying custom S3 endpoint, along with
diff --git a/packages/backend-common/src/reading/AwsS3UrlReader.ts b/packages/backend-common/src/reading/AwsS3UrlReader.ts
index d5de2a845c..4dd68bf32c 100644
--- a/packages/backend-common/src/reading/AwsS3UrlReader.ts
+++ b/packages/backend-common/src/reading/AwsS3UrlReader.ts
@@ -177,6 +177,7 @@ export class AwsS3UrlReader implements UrlReader {
         params: {
           RoleSessionName: 'backstage-aws-s3-url-reader',
           RoleArn: roleArn,
+          ExternalId: integration.config.externalId,
         },
       });
     }
diff --git a/packages/integration/api-report.md b/packages/integration/api-report.md
index 84bca54a90..d86acb291a 100644
--- a/packages/integration/api-report.md
+++ b/packages/integration/api-report.md
@@ -35,6 +35,7 @@ export type AwsS3IntegrationConfig = {
   accessKeyId?: string;
   secretAccessKey?: string;
   roleArn?: string;
+  externalId?: string;
 };
 
 // @public
diff --git a/packages/integration/config.d.ts b/packages/integration/config.d.ts
index dc62695385..e2d26be28e 100644
--- a/packages/integration/config.d.ts
+++ b/packages/integration/config.d.ts
@@ -225,6 +225,12 @@ export interface Config {
        * @visibility backend
        */
       roleArn?: string;
+
+      /**
+       * External ID to use when assuming role
+       * @visibility backend
+       */
+      externalId?: string;
     }>;
   };
 }
diff --git a/packages/integration/src/awsS3/config.ts b/packages/integration/src/awsS3/config.ts
index 45cbdbe210..477741b839 100644
--- a/packages/integration/src/awsS3/config.ts
+++ b/packages/integration/src/awsS3/config.ts
@@ -59,6 +59,11 @@ export type AwsS3IntegrationConfig = {
    * (Optional) ARN of role to be assumed
    */
   roleArn?: string;
+
+  /**
+   * (Optional) External ID to use when assuming role
+   */
+  externalId?: string;
 };
 
 /**
@@ -98,6 +103,7 @@ export function readAwsS3IntegrationConfig(
   const accessKeyId = config.getOptionalString('accessKeyId');
   const secretAccessKey = config.getOptionalString('secretAccessKey');
   const roleArn = config.getOptionalString('roleArn');
+  const externalId = config.getOptionalString('externalId');
 
   return {
     host,
@@ -106,6 +112,7 @@ export function readAwsS3IntegrationConfig(
     accessKeyId,
     secretAccessKey,
     roleArn,
+    externalId,
   };
 }