Error: Not authorized to perform sts:AssumeRoleWithWebIdentity

[shinebayar-g]

I followed this documentation to setup my OIDC provider.

OIDC trust relationship doc:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "https://github.com/my-org"
        }
      }
    }
  ]
}

Added permissions to workflow:

permissions:
  id-token: write
  contents: read  # It wasn't mentioned on the docs, without this checkout action doesn't work!

Unfortunately Github Actions doesn't work. I'm getting:

Error: Not authorized to perform sts:AssumeRoleWithWebIdentity

What's the fix?

[lorengordon]

Change:

          "token.actions.githubusercontent.com:aud": "https://github.com/my-org"

to:

          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"

Per that same doc you linked:

For the "Audience": Use sts.amazonaws.com if you are using the official action.

[shinebayar-g]

As others suggested changing

"StringEquals": {
          "token.actions.githubusercontent.com:aud": "https://github.com/my-org",
}

to

"StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
}

works.

[shinebayar-g]

Change:

          "token.actions.githubusercontent.com:aud": "https://github.com/my-org"

to:

          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"

Per that same doc you linked:

For the "Audience": Use sts.amazonaws.com if you are using the official action.

Ah I see. I definitely overlooked that part! Thank you very much.

[mathix420]

Thanks, that helped me finding my issue.
In my case the issue was also on the condition, I went from this

"Condition": {
    "ForAllValues:StringEquals": {
        "token.actions.githubusercontent.com:iss": "https://token.actions.githubusercontent.com",
        "token.actions.githubusercontent.com:sub": "repo:myusername/myrepo:*",
        "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
    }
}

To this

"Condition": {
    "StringLike": {
        "token.actions.githubusercontent.com:sub": "repo:myusername/myrepo:*"
    },
    "ForAllValues:StringEquals": {
        "token.actions.githubusercontent.com:iss": "https://token.actions.githubusercontent.com",
        "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
    }
}

Note the use of StringLike when using wildcards (*).

Thanks to @jigar-bhalodia for pointing out that using only a StringLike condition will return true when checking against empty objects, reason why the StringEquals condition is present.

Hope this can help someone else!

[Andrew-Chen-Wang]

that worked @mathix420 thanks! (made a PR in github docs)

[lucasgherculano]

If I want to allow all repos in the org how would that be?

"token.actions.githubusercontent.com:sub": "repo:org-name*",
tried this but it didnt work

[Andrew-Chen-Wang]

@lucasgherculano try org/* (ie missing the /)

[dankore]

If I want to allow all repos in the org how would that be?

"token.actions.githubusercontent.com:sub": "repo:org-name*", tried this but it didnt work

Try:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::XXXXXXXX/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "ForAllValues:StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:MY-ORG-NAME/*"
                }
            }
        }
    ]
}

[lucasgherculano]

Yes, i've done it, it worked, thanks

…

On Thu, Sep 22, 2022 at 5:48 PM Adamu Muhammad Dankore < ***@***.***> wrote: If I want to allow all repos in the org how would that be? "token.actions.githubusercontent.com:sub": "repo:org-name*", tried this but it didnt work *Try:* { "Version": "2008-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::XXXXXXXX/token.actions.githubusercontent.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "ForAllValues:StringLike": { "token.actions.githubusercontent.com:sub": "repo:MY-ORG-NAME/*" } } } ] } — Reply to this email directly, view it on GitHub <#318 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AW44T2RHW5PINH6ERYGBLILV7TA2FANCNFSM5I77KU4Q> . You are receiving this because you were mentioned.Message ID: ***@***.***>