Odis Harkins oharkins

Your workflow has id-token: write. The role ARN is right. The trust policy looks exactly like the one in every tutorial. And aws-actions/configure-aws-credentials still tells you to get lost:

Not authorized to perform sts:AssumeRoleWithWebIdentity

Nothing changed on the AWS side. Nothing changed in the workflow. So what broke?

The thing that changed was GitHub

GitHub now issues immutable OIDC subject claims for some repositories — new repos created after the rollout, plus repos that opted in, were renamed, or were transferred. The sub claim quietly grew a pair of numeric IDs:

Creating the Pipeline Execution Role

To deploy your Hugo site to AWS S3 using GitHub Actions OIDC, you’ll need to set up a specific IAM role. Here’s a step-by-step guide to creating and configuring this role.

Step 1: Configure the OIDC Provider

First, you need to create an OIDC provider in AWS IAM if you haven’t already:

1. Navigate to the AWS IAM Console
2. Go to Identity Providers
3. Click “Add Provider”
4. Select “OpenID Connect”
5. For the Provider URL, enter: https://token.actions.githubusercontent.com
6. For the Audience, enter: sts.amazonaws.com
7. Click “Add provider”

Step 2: Create the IAM Role

1. Go to IAM Roles in the AWS Console
2. Click “Create Role”
3. Select “Web Identity”
4. Choose the GitHub OIDC provider you just created
5. For the Audience, select sts.amazonaws.com
6. Add the following trust relationship:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<YOUR-AWS-ACCOUNT-ID>:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:<GITHUB-USERNAME>/<REPOSITORY-NAME>:*"
                }
            }
        }
    ]
}

Replace: