diff --git a/packages/backend-common/src/reading/AwsS3UrlReader.ts b/packages/backend-common/src/reading/AwsS3UrlReader.ts
index e64334321d..86ff0e7d65 100644
--- a/packages/backend-common/src/reading/AwsS3UrlReader.ts
+++ b/packages/backend-common/src/reading/AwsS3UrlReader.ts
@@ -154,11 +154,15 @@ export class AwsS3UrlReader implements UrlReader {
 
     const roleArn = integration.config.roleArn;
     if (roleArn) {
+      const externalIdParam = integration.config.externalId
+        ? { ExternalId: integration.config.externalId }
+        : {};
       return new aws.ChainableTemporaryCredentials({
         masterCredentials: explicitCredentials,
         params: {
           RoleSessionName: 'backstage-aws-s3-url-reader',
           RoleArn: roleArn,
+          ...externalIdParam,
         },
       });
     }
diff --git a/packages/integration/config.d.ts b/packages/integration/config.d.ts
index 8873f0f220..0b88a8ff81 100644
--- a/packages/integration/config.d.ts
+++ b/packages/integration/config.d.ts
@@ -200,6 +200,12 @@ export interface Config {
        * @visibility backend
        */
       roleArn?: string;
+
+      /**
+       * External ID to use when assuming role
+       * @visibility backend
+       */
+      externalId?: string;
     }>;
   };
 }
diff --git a/packages/integration/src/awsS3/config.ts b/packages/integration/src/awsS3/config.ts
index 45cbdbe210..2054b9eab0 100644
--- a/packages/integration/src/awsS3/config.ts
+++ b/packages/integration/src/awsS3/config.ts
@@ -59,6 +59,11 @@ export type AwsS3IntegrationConfig = {
    * (Optional) ARN of role to be assumed
    */
   roleArn?: string;
+
+  /**
+   * (optional) External ID to use when assuming role
+   */
+  externalId?: string;
 };
 
 /**
@@ -98,6 +103,7 @@ export function readAwsS3IntegrationConfig(
   const accessKeyId = config.getOptionalString('accessKeyId');
   const secretAccessKey = config.getOptionalString('secretAccessKey');
   const roleArn = config.getOptionalString('roleArn');
+  const externalId = config.getOptionalString('externalId');
 
   return {
     host,
@@ -106,6 +112,7 @@ export function readAwsS3IntegrationConfig(
     accessKeyId,
     secretAccessKey,
     roleArn,
+    externalId,
   };
 }