Your workflow has id-token: write. The role ARN is right. The trust policy looks exactly like the one in every tutorial. And aws-actions/configure-aws-credentials still tells you to get lost:

Not authorized to perform sts:AssumeRoleWithWebIdentity

Nothing changed on the AWS side. Nothing changed in the workflow. So what broke?

The thing that changed was GitHub

GitHub now issues immutable OIDC subject claims for some repositories — new repos created after the rollout, plus repos that opted in, were renamed, or were transferred. The sub claim quietly grew a pair of numeric IDs:

Setting Up CloudFront Functions for Hugo Page Routing

When hosting a Hugo site on AWS CloudFront, URLs ending with a trailing slash (like /about/) don’t automatically resolve to their corresponding index.html files. While Lambda@Edge can solve this, CloudFront Functions provide a more cost-effective and faster solution. This article will guide you through setting up a CloudFront Function to handle this routing properly.

Why CloudFront Functions?

CloudFront Functions are a perfect fit for this URL rewriting task because:

Creating the Pipeline Execution Role

To deploy your Hugo site to AWS S3 using GitHub Actions OIDC, you’ll need to set up a specific IAM role. Here’s a step-by-step guide to creating and configuring this role.

Step 1: Configure the OIDC Provider

First, you need to create an OIDC provider in AWS IAM if you haven’t already:

1. Navigate to the AWS IAM Console
2. Go to Identity Providers
3. Click “Add Provider”
4. Select “OpenID Connect”
5. For the Provider URL, enter: https://token.actions.githubusercontent.com
6. For the Audience, enter: sts.amazonaws.com
7. Click “Add provider”

Step 2: Create the IAM Role

1. Go to IAM Roles in the AWS Console
2. Click “Create Role”
3. Select “Web Identity”
4. Choose the GitHub OIDC provider you just created
5. For the Audience, select sts.amazonaws.com
6. Add the following trust relationship:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<YOUR-AWS-ACCOUNT-ID>:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:<GITHUB-USERNAME>/<REPOSITORY-NAME>:*"
                }
            }
        }
    ]
}

Replace:

In today’s digital world, image recognition and matching have become crucial in various applications. AWS API Gateway, coupled with AWS Rekognition, offers a powerful combination to upload and process images, enabling us to find the closest matches effortlessly. In this article, we will explore how to utilize AWS API Gateway to upload images and leverage Velocity Template Language (VTL) to construct requests for AWS Rekognition to identify the closest image matches.