aws role authorization failing from github OIDC

[vineetguptadev]

Describe the bug

Trying to use the Github OIDC--> AWS IAM role workflow and it fails with the error.

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]
  workflow_dispatch:

env:
  AWS_REGION: us-east-1
  ECR_REPOSITORY: xzy-v123
  IMAGE_TAG: ${{ github.sha }}

permissions:
  id-token: write
  contents: read

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}

Fails with below error:

Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

AWS IAM Role Trust Policy:
AWS IAM role name: arn:aws:iam::xxxxxxxxx:role/GitHubActions

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxxxxxx:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:sub": "repo:MyOrg/xzy-v123:ref:refs/heads/*",
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

What is the issue , please help !

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

We should be able to authenticate using the AWS IAM role to via Github OIDC to access AWS Resources.

Current Behavior

Failing to authenticate to AWS via the IAM role given in github actions workflow.

Reproduction Steps

Use the above mechanisms to create role + Actions to authenticate

Possible Solution

No response

Additional Information/Context

No response

[lehmanmj]

Hi Vineet, in your IAM role trust policy, you're using a wildcard operator inside of a StringEquals condition.

If you change the trust policy condition to something like the block below, does the workflow work?

"Condition": {
  "StringEquals": {
    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
  },
  "StringLike": {
    "token.actions.githubusercontent.com:sub": "repo:MyOrg/xzy-v123:ref:refs/heads/*"
  }
}

[whatisyourname0]

I'm facing some similar issues these recent days regarding to github OIDC token authentications. They worked pretty well before.

The following is the configured trusted entities for github action role.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::123412341234:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:sub": "repo:MyOrg/MyRepo:ref:refs/heads/main",
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

[lehmanmj]

Hi whatisyourname0, I was not able to reproduce your issue. Is your workflow using the exact ARN of that role as the role-to-assume? Also, which version of configure-aws-credentials are you using?

[whatisyourname0]

Hi, thanks for your reply.

I was using v4, and I double-checked the role ARN as well.
However, after some time (and a good night's sleep), the issue seems to have magically resolved itself.
I'll keep an eye on it, and if the problem pops up again, I'll follow up here.

Thanks again for looking into it!