diff --git a/awsutil/generate_credentials.go b/awsutil/generate_credentials.go
index 224f177..dc29b84 100644
--- a/awsutil/generate_credentials.go
+++ b/awsutil/generate_credentials.go
@@ -254,7 +254,9 @@ func (c *CredentialsConfig) generateAwsConfigOptions(ctx context.Context, opts o
 			assumeRoleCred := config.WithAssumeRoleCredentialOptions(func(options *stscreds.AssumeRoleOptions) {
 				options.RoleARN = c.RoleARN
 				options.RoleSessionName = c.RoleSessionName
-				options.ExternalID = aws.String(c.RoleExternalId)
+				if c.RoleExternalId != "" {
+					options.ExternalID = aws.String(c.RoleExternalId)
+				}
 				for k, v := range c.RoleTags {
 					options.Tags = append(options.Tags, types.Tag{
 						Key:   aws.String(k),
diff --git a/awsutil/generate_credentials_test.go b/awsutil/generate_credentials_test.go
index 145ca4d..af7128d 100644
--- a/awsutil/generate_credentials_test.go
+++ b/awsutil/generate_credentials_test.go
@@ -474,6 +474,25 @@ func TestGenerateAwsConfigOptions(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "assume role credential without external id",
+			cfg: func() *CredentialsConfig {
+				credCfg, err := NewCredentialsConfig(
+					WithRoleArn("foo"),
+					WithRoleSessionName("bar"),
+				)
+				require.NoError(t, err)
+				return credCfg
+			}(),
+			expectedLoadOptions: config.LoadOptions{
+				Region: "us-east-1",
+			},
+			expectedAssumeRoleOptions: &stscreds.AssumeRoleOptions{
+				RoleARN:         "foo",
+				RoleSessionName: "bar",
+				ExternalID:      nil,
+			},
+		},
 		{
 			name: "static credential",
 			cfg: func() *CredentialsConfig {