What are you trying to do?
I want a GitHub Actions workflow to deploy resources to AWS without storing long-lived AWS access keys in GitHub Secrets. The workflow should authenticate to AWS using OpenID Connect (OIDC), assume an IAM role, and then run AWS CLI commands.
What happened?
I configured an IAM role in AWS and added the aws-actions/configure-aws-credentials action to the workflow. However, the workflow fails when trying to assume the role and returns an AccessDenied error for sts:AssumeRoleWithWebIdentity.
What did you expect?
What have you tried?
I created the GitHub OIDC provider in AWS using: https://token.actions.githubusercontent.com I also created an IAM role with a trust relationship for GitHub Actions and configured the workflow with id-token: write. I verified that the AWS account ID and IAM role ARN are correct, but the AssumeRoleWithWebIdentity request is still denied.
Environment
GitHub Actions AWS IAM AWS STS GitHub OIDC Ubuntu GitHub-hosted runner AWS CLI v2
Relevant code or error
name: Deploy to AWS
on:
workflow_dispatch:
permissions:
id-token: write
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
aws-region: us-east-1
- name: Verify identity
run: aws sts get-caller-identity
Comments 1
Need more clarification on this
Sign in to add clarification.