Category See all →

Cloud & Infrastructure

Cloud services, Kubernetes, servers, storage, cost surprises.

76 stories

Banner: GitHub Actions OIDC role assumption denied by AWS because of a subject claim mismatch

DevOps & CI/CD Bug Report

GitHub Actions OIDC to AWS: Not authorized to perform sts:AssumeRoleWithWebIdentity

Ryan Pham · Oct 30, 2024 · 7 min read

Our deploy job worked on main and failed on the production environment with Not authorized to perform sts:AssumeRoleWithWebIdentity. Using a GitHub environment changes the OIDC subject claim. We rewrote the trust policy around exact subjects instead of wildcards.