diff --git a/packages/backend-common/src/reading/AwsS3UrlReader.ts b/packages/backend-common/src/reading/AwsS3UrlReader.ts
index b3c7aae3bf..4dd68bf32c 100644
--- a/packages/backend-common/src/reading/AwsS3UrlReader.ts
+++ b/packages/backend-common/src/reading/AwsS3UrlReader.ts
@@ -172,15 +172,12 @@ export class AwsS3UrlReader implements UrlReader {
 
     const roleArn = integration.config.roleArn;
     if (roleArn) {
-      const externalIdParam = integration.config.externalId
-        ? { ExternalId: integration.config.externalId }
-        : {};
       return new aws.ChainableTemporaryCredentials({
         masterCredentials: explicitCredentials,
         params: {
           RoleSessionName: 'backstage-aws-s3-url-reader',
           RoleArn: roleArn,
-          ...externalIdParam,
+          ExternalId: integration.config.externalId,
         },
       });
     }
diff --git a/packages/integration/src/awsS3/config.ts b/packages/integration/src/awsS3/config.ts
index 2054b9eab0..477741b839 100644
--- a/packages/integration/src/awsS3/config.ts
+++ b/packages/integration/src/awsS3/config.ts
@@ -61,7 +61,7 @@ export type AwsS3IntegrationConfig = {
   roleArn?: string;
 
   /**
-   * (optional) External ID to use when assuming role
+   * (Optional) External ID to use when assuming role
    */
   externalId?: string;
 };