A GitHub Actions job can print the expected repository and branch yet still receive Not authorized to perform sts:AssumeRoleWithWebIdentity because AWS evaluates the OIDC token’s sub claim—not the workflow’s separate github.repository and github.ref values. Since July 15, 2026, some GitHub.com repositories use a subject format that adds immutable owner and repository IDs, so an older AWS trust condition may no longer match.
Why a seemingly correct GitHub OIDC policy can fail
GitHub Actions can request a signed JSON Web Token (JWT) from GitHub’s OIDC provider for a job. Before AWS issues temporary credentials, it checks the token’s claims against the role’s configured trust policy. The sub (subject) is one of the claims that must match. Printing github.repository and github.ref confirms workflow context values; it does not show the exact subject AWS is evaluating. GitHub’s OpenID Connect documentation describes this token-and-trust validation flow.
As an Amazon Associate I earn from qualifying purchases.
That check happens before the workflow can use the assumed role to access S3. If role assumption is denied, first diagnose the OIDC trust relationship; bucket permissions become relevant only after credentials are issued.
Free tools Windows power users keep installed
One-click scans. No signup required.
What changed in GitHub’s OIDC subject
GitHub’s legacy default subject used repository names, for example repo:octocat/my-repo:ref:refs/heads/main. The newer default includes immutable owner and repository IDs, separated from names by @, as in repo:octocat@123456/my-repo@456789:ref:refs/heads/main. GitHub says the IDs bind the subject to the original owner and repository identities. See the GitHub changelog on immutable subject claims.
#1 Best Overall
- On GitHub.com, repositories created after July 15, 2026 use the immutable-ID format automatically.
- Repositories renamed or transferred after that date also adopt it.
- Existing repositories are not changed automatically unless they opt in through repository or organization OIDC settings.
- The rollout applies to GitHub.com, not GitHub Enterprise Server (GHES).
The changelog was published April 23, 2026, and an editor’s note dated June 10, 2026 clarified that @ is the delimiter. GitHub also documents a preview endpoint for the expected subject prefix and an option to opt in through the settings UI or API.
How to diagnose an AssumeRoleWithWebIdentity denial
- Confirm the job can request an OIDC token. Check the workflow’s permissions and ensure it grants
id-token: write. Without that permission, the job may not obtain a token at all; that differs from a token successfully issued and then rejected by AWS. - Inspect claims safely. Determine the actual
sub, issuer, audience, and relevant ref or environment context using a method that does not leave a bearer token in persistent logs. Compare the claim itself—not just workflow variables—with the conditions in the AWS role’s trust policy. - Check the repository’s rollout status. Establish whether it was created, renamed, or transferred after July 15, 2026, or explicitly opted into immutable subjects. Use GitHub’s documented preview capability where available to check the expected subject prefix.
- Make the trust condition match the intended workflow. Update the AWS-side condition to accept the subject format actually issued, while keeping it restricted to the intended repository and deployment context. If supporting both legacy and immutable formats during a transition, ensure the immutable alternative pins the intended owner and repository IDs.
- Only then investigate S3 authorization. Once AWS successfully assumes the role, check the role’s S3 permissions and any relevant bucket policy if an S3 operation fails.
Match the trust policy to the workflow context
A branch-based subject and an environment-based subject are not interchangeable. GitHub’s subject can vary with context, including whether a job references an environment. Check the actual token and the conditions configured by AWS before changing a policy; do not assume that a branch-only pattern is appropriate for a workflow using an environment or another subject template.
The reported incident behind this story describes an Astro static-site deployment to AWS S3. Its author says the role existed and the printed repository and ref looked right, but the token subject had gained immutable IDs while the AWS condition still expected names alone. The displayed old and new patterns were structurally equivalent to repo:OWNER/REPO:ref:refs/heads/BRANCH and repo:OWNER@OWNER-ID/REPO@REPO-ID:ref:refs/heads/BRANCH. These are illustrative patterns from that account, not a universal AWS policy template; replace them only after verifying your own token’s claims and deployment context.
What this error does—and does not—tell you
Not authorized to perform sts:AssumeRoleWithWebIdentity points to failure at the role-assumption stage in the reported AWS case. It does not, by itself, prove that the S3 bucket policy is wrong or that the repository/ref values printed by the workflow are incorrect. The error alone also does not establish whether the job failed to obtain a token or AWS rejected an issued token; check token permissions and trust-condition matching separately.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
