Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11First identify whether GitHub Actions was denied while requesting AWS credentials or while using credentials it already obtained. A failure at sts:AssumeRoleWithWebIdentity points to the IAM role’s trust relationship and OIDC token claims. If role assumption succeeded and a later AWS API call fails, check the role session’s permissions and other policy controls that apply to that action.
Identify where the denial occurs
GitHub Actions uses an OpenID Connect (OIDC) token to request temporary credentials for an AWS IAM role. That request is separate from the AWS service operations the workflow runs after receiving credentials: successfully entering the role does not mean the session can perform every action.
As an Amazon Associate I earn from qualifying purchases.
| Diagnostic clue | Trust-policy or role-assumption failure | Permissions-policy or later action failure |
|---|---|---|
| Stage | Request to obtain the role session | AWS service action made with the session |
| Action in the error | Often sts:AssumeRoleWithWebIdentity |
The specific service action that was denied |
| First area to inspect | Federated provider, trust-policy action, and token conditions | Denied action and resource, role permissions, and applicable policy controls |
AWS describes both missing trust-policy Allows and missing identity-based Allows as possible causes of access-denied errors. An error may identify only one policy type even when multiple policy types affect the request. See AWS IAM’s access-denied troubleshooting guide.
If AWS denies the role-assumption request
Inspect the role’s trust policy and compare it with the OIDC provider and token context used by the workflow. The trust policy decides which federated identities may enter the role; it is distinct from the permissions policy that governs what a role session may do afterward.
#1 Best Overall
Verify the federated provider and allowed action
- Confirm the target AWS account has an IAM OIDC provider for
token.actions.githubusercontent.com. - In the role trust policy, check that
Principal.Federatedrefers to that provider’s ARN, which ends inoidc-provider/token.actions.githubusercontent.com. - Check that the trust policy allows
sts:AssumeRoleWithWebIdentity.
AWS documents the OIDC federated principal pattern in its policy Principal reference and identifies GitHub Actions’ OIDC provider and role controls in its shared OIDC provider guidance.
Match the audience and subject conditions
Compare the trust policy’s conditions with the claims in the token for the workflow that failed. AWS’s GitHub example constrains token.actions.githubusercontent.com:aud to sts.amazonaws.com and scopes token.actions.githubusercontent.com:sub to a repository and branch. A mismatch in the expected audience, repository, ref, or subject format can prevent role assumption. AWS shows these context keys in its IAM and STS condition-key reference.
Keep the subject restriction narrow enough to identify the repositories and refs that should assume the role. AWS IAM Access Analyzer warns: “Granting a federated GitHub principal permissions without a condition key can allow more sources to assume the role than you intended.” See the Access Analyzer policy validation reference.
Free tools Windows power users keep installed
One-click scans. No signup required.
If role assumption worked but an AWS action failed
When the workflow has obtained credentials and a later service call returns AccessDenied, start with the exact denied action and resource. Check whether the role’s identity-based policy allows that operation on that resource, and whether the request satisfies any conditions attached to the Allow.
Then inspect explicit Deny statements, permissions boundaries, and other policy types that may apply to the request. An Allow in one policy does not by itself establish that the full authorization evaluation permits the action. AWS notes that access-denied errors can name only one of multiple policy types involved, so do not stop at the first policy mentioned in the message.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use authorization details when AWS provides an ID
For supported denied API requests, an error may include an authorization ID. AWS documents using that ID with GetRequestAuthorizationDetails in the same Region to inspect evaluated action-resource pairs and policy outcomes. An ID is not guaranteed for every denial.
AWS labels Access Troubleshooter as a public preview and says recorded authorization details are retained for 24 hours after a denial. Check the current AWS authorization-ID troubleshooting documentation for availability and usage details.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
