oidc custom claim for actor not working

[Ravi-Gupta77]

Description

I had created github oidc role & provider with custom claim for github actor, encounter error when using
created role in github action workflow

If your request is for a new feature, please use the Feature request template.

• ✋ I have searched the open/closed issues and my issue is not listed.

Versions

• Module version [Required]:
  v5.54.0
• Terraform version:
  Terraform v1.9.4
• Provider version(s):
  aws v4.67.0

Reproduction Code [Required]

module "github_oidc_provider" {
source = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-provider"
url = "https://token.actions.githubusercontent.com"

additional_thumbprints = [
"6938fd4d98bab03faadb97b34396831e3780aea1",
"1c58a3a8518e8759bf075b76b750d4f2df264fcd"
]
}

module "github_oidc_role" {
source = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-role"
name = "cts-github-oidc"
subjects = [
"repo:organization1/",
"repo:organization2/"
]

additional_trust_policy_conditions = [
{
test = "ForAnyValue:StringEquals"
variable = "token.actions.githubusercontent.com:actor"
values = [ "user1",
"user2",
"user3"
]
}
]

policies = {
AdministratorAccess = "arn:aws:iam::aws:policy/AdministratorAccess"
}
}

Steps to reproduce the behavior:
terraform init
terraform plan
terraform apply

Expected behavior

I trying to restrict access using a custom claim (i.e actor), when oidc role is being used in github action workflow
Only selected no of users within github organization can access using oidc role

Actual behavior

Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

Terminal Output Screenshot(s)

Additional context

trust policy created

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GithubOidcAuth",
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::833227482620:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": [
                "sts:TagSession",
                "sts:AssumeRoleWithWebIdentity"
            ],
            "Condition": {
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": [
                        "repo:organization1/*",
                        "repo:organization2/*"
                    ]
                },
                "ForAllValues:StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
                    "token.actions.githubusercontent.com:iss": "https://token.actions.githubusercontent.com"
                },
                "ForAnyValue:StringEquals": {
                    "token.actions.githubusercontent.com:actor": [
                        "user1",
                        "user2",
                        "user3"
                    ]
                }
            }
        }
    ]
}