Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A GitHub Actions job can print the expected repository and branch yet still be denied by AWS: those workflow values are not the same thing as the JWT’s sub claim, which AWS evaluates against the role’s OIDC trust policy. Since July 15, 2026, eligible GitHub.com repositories may use a subject format containing immutable owner and repository IDs, so a trust condition written for the older name-only format may no longer match.
What the reported failure shows
A September 24, 2026 search result attributes a reported Astro-to-S3 deployment failure to Kishan Patel. The error was Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity. The account says the AWS role existed and the workflow’s printed github.repository and github.ref values looked consistent with the trust policy. The eventual mismatch, according to that account, was the token’s sub: it had changed to include immutable IDs, while the policy still expected the name-only subject format. The publisher page could not be independently checked, so this is the author’s reported diagnosis, not an independently reproduced incident.
The important distinction is that repository and ref context values are not themselves proof that the token’s subject matches the condition AWS evaluates. A workflow may show the expected repository and branch while its issued subject has a different structure.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How GitHub OIDC role assumption works
A job can request a signed JWT from GitHub’s OIDC provider. The cloud provider checks the token’s subject and other claims against the trust definition configured for the cloud role. If those checks pass, the provider issues short-lived cloud credentials for the job. GitHub describes this flow in its OpenID Connect documentation.
#1 Best Overall
This makes the point of failure important. sts:AssumeRoleWithWebIdentity is the AWS role-assumption step. If AWS rejects the identity there, permissions to write objects to the S3 bucket are a later question: bucket access and role assumption are separate authorization layers.
Why the GitHub subject format changed
GitHub’s older default subject format used names, for example repo:octocat/my-repo:ref:refs/heads/main. Its newer format includes immutable owner and repository IDs alongside those names, separated by @; GitHub’s example is repo:octocat@123456/my-repo@456789:ref:refs/heads/main. GitHub says the IDs bind the subject to the original organization and repository identity, even if names change. See the GitHub changelog announcement.
The rollout applies on github.com, not GitHub Enterprise Server (GHES). New repositories created after July 15, 2026 use the immutable format automatically; repositories renamed or transferred after that date also adopt it. Existing repositories are not changed unless they opt in. GitHub published the announcement on April 23, 2026, and added a June 10 editor’s note clarifying the @ delimiter.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Repository situation | Expected subject behavior |
|---|---|
| Existing GitHub.com repository, not opted in and not renamed or transferred after July 15, 2026 | Not automatically changed by this rollout, according to GitHub’s changelog. |
| GitHub.com repository created after July 15, 2026 | Uses the immutable-ID subject format automatically. |
| GitHub.com repository renamed or transferred after July 15, 2026 | Adopts the immutable-ID subject format. |
| Existing GitHub.com repository opted in through OIDC settings | Uses the opted-in subject format; GitHub provides UI/API settings and a preview endpoint. |
| GitHub Enterprise Server | This rollout does not apply, as stated by GitHub. |
How to diagnose an OIDC trust-policy denial
- Check token permission first. Confirm the workflow grants
id-token: writewhere needed. Without permission to request an OIDC token, the job may fail before presenting a token for AWS to validate. That differs from a token issued and then rejected by the trust condition. - Inspect claims safely. Compare the actual
sub, issuer, audience, and relevant ref or environment context with the conditions in the AWS role’s trust policy. Do not print a bearer token into durable workflow logs; use a controlled diagnostic method that avoids exposing the token. - Establish which subject format applies. Check when the repository was created and whether it was renamed, transferred, or opted into the new format. GitHub documents a preview endpoint for the expected subject prefix, which can help verify the format before changing cloud policy.
- Make the trust condition match the intended identity. Update the AWS condition to match the actual subject and the deployment context you intend to authorize. Keep it narrow enough to limit access to the intended repository and workflow circumstances.
- Test the next authorization layer only after assumption succeeds. Once AWS issues role credentials, investigate the role’s S3 permissions and any bucket policy if deployment still fails.
Match the entire subject, not just the branch
The reported legacy condition had the structural form repo:OWNER/REPO:ref:refs/heads/BRANCH; its reported immutable alternative had the form repo:OWNER@OWNER-ID/REPO@REPO-ID:ref:refs/heads/BRANCH. These are structural examples, not copy-ready policies. The original account’s exact AWS configuration was not independently reviewed, and allowing both formats is not automatically the right choice for every deployment.
Subject shape depends on workflow context. GitHub documents subjects that use an environment as well as ref-based subjects. A policy that assumes every deployment has a branch-shaped subject can therefore fail—or authorize a different context than intended—when the workflow uses an environment or another subject template. Compare the exact issued claim with the exact trust condition, then constrain the condition to the deployment path you mean to permit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a matching policy does—and does not—prove
A successful subject match establishes that the identity satisfied the configured role trust conditions; it does not by itself grant S3 access. AWS must still authorize the role’s requested actions against its permissions and applicable resource policies. Conversely, changing S3 permissions cannot fix a role assumption rejected at the OIDC trust check.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
