diff --git a/internal/temporalcli/commands.gen.go b/internal/temporalcli/commands.gen.go
index ca95a64b2..41ff6f18a 100644
--- a/internal/temporalcli/commands.gen.go
+++ b/internal/temporalcli/commands.gen.go
@@ -3665,8 +3665,8 @@ func NewTemporalWorkerDeploymentCreateVersionCommand(cctx *CommandContext, paren
 	}
 	s.Command.Args = cobra.NoArgs
 	s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.")
-	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.")
-	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.")
+	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version.")
+	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value.")
 	s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
 	s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
 	s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.")
@@ -4005,8 +4005,8 @@ func NewTemporalWorkerDeploymentUpdateVersionComputeConfigCommand(cctx *CommandC
 	}
 	s.Command.Args = cobra.NoArgs
 	s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.")
-	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.")
-	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.")
+	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version.")
+	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value.")
 	s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
 	s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
 	s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.")
diff --git a/internal/temporalcli/commands.worker.deployment.go b/internal/temporalcli/commands.worker.deployment.go
index 2f788ae2f..5274e39ad 100644
--- a/internal/temporalcli/commands.worker.deployment.go
+++ b/internal/temporalcli/commands.worker.deployment.go
@@ -990,10 +990,8 @@ func (c *TemporalWorkerDeploymentManagerIdentityUnsetCommand) run(cctx *CommandC
 }
 
 func validateAWSLambdaProviderDetails(details map[string]any) error {
-	for _, key := range []string{"arn", "role", "role_external_id"} {
-		if _, ok := details[key]; !ok {
-			return fmt.Errorf("missing required AWS Lambda provider detail: %s", key)
-		}
+	if v, ok := details["arn"].(string); !ok || v == "" {
+		return fmt.Errorf("missing required AWS Lambda provider detail: arn")
 	}
 	return nil
 }
diff --git a/internal/temporalcli/commands.worker.deployment_test.go b/internal/temporalcli/commands.worker.deployment_test.go
index e1a7115b4..1d56fc8f2 100644
--- a/internal/temporalcli/commands.worker.deployment_test.go
+++ b/internal/temporalcli/commands.worker.deployment_test.go
@@ -1290,6 +1290,9 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() {
 	s.Error(res.Err)
 	s.ErrorContains(res.Err, "failed to assume role arn:aws:iam::123456789012:role/MyServiceRole: operation error STS: AssumeRole")
 
+	// The CLI does not require role/external ID; the server enforces them when
+	// its require_role_and_external_id setting is true (the default here), so
+	// omitting either is rejected server-side.
 	missingExternalIDBuildID := uuid.NewString()
 
 	res = s.Execute(
@@ -1301,7 +1304,7 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() {
 		"--aws-lambda-assume-role-arn", assumeRoleARN,
 	)
 	s.Error(res.Err)
-	s.ErrorContains(res.Err, "missing required AWS Lambda provider detail: role_external_id")
+	s.ErrorContains(res.Err, `AWS Lambda compute provider requires "role_external_id" to be configured`)
 
 	missingAssumeRoleBuildID := uuid.NewString()
 
@@ -1313,7 +1316,7 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() {
 		"--aws-lambda-function-arn", invokeARN,
 	)
 	s.Error(res.Err)
-	s.ErrorContains(res.Err, "missing required AWS Lambda provider detail: role")
+	s.ErrorContains(res.Err, `AWS Lambda compute provider requires "role" to be configured`)
 
 	// --gcp-cloud-run-worker-pool requires project, region, and
 	// service-account; the first missing detail key is reported.
diff --git a/internal/temporalcli/commands.yaml b/internal/temporalcli/commands.yaml
index 542ded558..4bbec2d79 100644
--- a/internal/temporalcli/commands.yaml
+++ b/internal/temporalcli/commands.yaml
@@ -1135,15 +1135,13 @@ commands:
         description: |
           AWS IAM role ARN that the Temporal server will assume when invoking
           the Lambda function that spawns a new Worker in this Worker
-          Deployment Version. Required when --aws-lambda-function-arn is
-          specified.
+          Deployment Version.
       - name: aws-lambda-assume-role-external-id
         type: string
         description: |
           Temporal server will enforce that the AWS IAM trust policy associated
           with the AWS IAM role specified in --aws-lambda-assume-role-arn has
-          an aws:ExternalId condition that matches the supplied value. Required
-          when --aws-lambda-function-arn is specified.
+          an aws:ExternalId condition that matches the supplied value.
       - name: gcp-cloud-run-project
         type: string
         description: |
@@ -1486,15 +1484,13 @@ commands:
         description: |
           AWS IAM role ARN that the Temporal server will assume when invoking
           the Lambda function that spawns a new Worker in this Worker
-          Deployment Version. Required when --aws-lambda-function-arn is
-          specified.
+          Deployment Version.
       - name: aws-lambda-assume-role-external-id
         type: string
         description: |
           Temporal server will enforce that the AWS IAM trust policy associated
           with the AWS IAM role specified in --aws-lambda-assume-role-arn has
-          an aws:ExternalId condition that matches the supplied value. Required
-          when --aws-lambda-function-arn is specified.
+          an aws:ExternalId condition that matches the supplied value.
       - name: gcp-cloud-run-project
         type: string
         description: |