OIDC not working with jobs.<job_id>.environment

[rkyuragi]

Describe the bug

When specifying jobs.<job_id>.environment in the workflow, OIDC fails.

Expected Behavior

It should be able to fetch credentials using a GitHub App token from a workflow under the GitHub repo that was setup in the Identity Provider on AWS side.

Current Behavior

Executing the workflow results in the following error.

Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

Reproduction Steps

This occurs when executing the following workflow.
Please configure the role-to-assume according to your environment.

name: CI/CD Workflow

on:
  push:
    branches:
      - test

jobs:
  set-env:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    environment: develop
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: 'ap-northeast-1'
          role-session-name: samplerolesession
          role-to-assume: 'arn:aws:iam::xxxx:role/xxxxx'

Commenting out the above environment: develop will result in success.

Possible Solution

No response

Additional Information/Context

No response

[tim-finnigan]

Hi @rkyuragi thanks for reaching out. I tried reproducing the error given the template you provided but I was not able to - it ran successfully. There are a few other issues referencing the error that you mentioned, I wonder if this solution might help out here. Can you confirm?

[rkyuragi]

Hi @tim-finnigan
Thank you so much!

Your sharing of another issue helped me resolve it!
It was due to a lack of the following in the trust policy I created.

repo:OWNER/REPOSITORY:environment:NAME

If you use a workflow with an environment, the sub field must reference the environment name: repo:OWNER/REPOSITORY:environment:NAME. 

document

[github-actions]

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.