diff --git a/.changeset/lemon-tables-train.md b/.changeset/lemon-tables-train.md
new file mode 100644
index 0000000000..80b64bfe53
--- /dev/null
+++ b/.changeset/lemon-tables-train.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-aws': patch
+---
+
+Added support for `externalId` when assuming role in `AwsS3EntityProvider`
diff --git a/plugins/catalog-backend-module-aws/src/credentials/AwsCredentials.ts b/plugins/catalog-backend-module-aws/src/credentials/AwsCredentials.ts
index ffb84d1c34..fded78aed4 100644
--- a/plugins/catalog-backend-module-aws/src/credentials/AwsCredentials.ts
+++ b/plugins/catalog-backend-module-aws/src/credentials/AwsCredentials.ts
@@ -27,6 +27,7 @@ export class AwsCredentials {
       accessKeyId?: string;
       secretAccessKey?: string;
       roleArn?: string;
+      externalId?: string;
     },
     roleSessionName: string,
   ): Credentials | CredentialsOptions | undefined {
@@ -52,6 +53,7 @@ export class AwsCredentials {
         params: {
           RoleArn: roleArn,
           RoleSessionName: roleSessionName,
+          ExternalId: config.externalId,
         },
       });
     }