iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
First identify when the failure occurs. If AWS rejects sts:AssumeRoleWithWebIdentity, investigate the IAM role’s trust policy and the GitHub OIDC token claims. If the workflow already obtained role credentials and a later AWS API call returns AccessDenied, investigate permissions for that service action and any other policy controls that apply.
Which stage is returning AccessDenied?
GitHub Actions uses an OpenID Connect (OIDC) token to ask AWS Security Token Service (STS) for temporary credentials associated with an IAM role. That role-assumption request is separate from the AWS operations the workflow performs afterward.
| Diagnostic clue | Role-assumption failure | Post-assumption permissions failure |
|---|---|---|
| When it happens | While requesting the role session | When an AWS service action runs with the session |
| Action commonly named | sts:AssumeRoleWithWebIdentity |
The specific service action that was denied |
| First policy area to inspect | Role trust relationship, federated principal, and OIDC claim conditions | Role permissions, action and resource scope, conditions, explicit denies, and other applicable controls |
| First concrete check | Provider ARN, allowed STS action, and matching aud and sub |
Exact denied action and resource, then the policies evaluated for them |
A missing trust-policy Allow can prevent role assumption; an explicit Deny in the trust policy can also block it. Once assumption succeeds, a missing Allow in the role’s permissions can deny a later service call. AWS notes that an error can identify only one policy type even when multiple policy types contribute to a denial, so the named policy may not be the only one to review. AWS IAM: Troubleshoot access denied error messages
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If role assumption fails, check the trust policy and token
Confirm the federated provider and STS action
In the target AWS account, confirm that the GitHub OIDC identity provider is registered and that the role trust policy’s Principal.Federated points to its provider ARN. AWS’s GitHub example uses an ARN ending in oidc-provider/token.actions.githubusercontent.com and allows sts:AssumeRoleWithWebIdentity. A mismatch in the provider, principal, or action can prevent the workflow from entering the role.
#1 Best Overall
See AWS’s descriptions of federated principals in IAM policies and identity-provider controls for shared OIDC providers.
Match the audience and subject conditions
Compare the trust policy conditions with the claims in the token issued for the workflow that failed. AWS’s example expects the audience (aud) to be sts.amazonaws.com and scopes the subject (sub) to a repository and branch. A repository name, branch, or subject format that does not match the workflow’s actual token context can make the trust condition fail. AWS’s IAM and STS condition context key examples show the GitHub audience and subject conditions.
Keep the subject restriction narrow enough to match the intended source. AWS IAM Access Analyzer warns: “Granting a federated GitHub principal permissions without a condition key can allow more sources to assume the role than you intended.” See its policy validation guidance.
If credentials were issued, check permissions for the denied action
If the workflow obtained AWS credentials and a later service API call failed, start with the exact action and resource shown by the error or failing command. Check whether the role’s identity-based policies allow that action on that resource, and whether applicable conditions are satisfied.
- Look for an explicit Deny in policies that apply to the role or session.
- Check whether a permissions boundary or another applicable policy limits the permission.
- Review relevant resource and organization-level controls as well as the role’s identity-based policies.
- Do not stop at the policy type named in the error: AWS says an error may report only one of several policy types involved in a denial.
AWS’s access-denied guidance describes how different policy types can affect a request. Which controls apply depends on the action, resource, and account setup.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use an authorization ID when AWS provides one
For supported denied API requests, an error may include an authorization ID. AWS documents using that ID with GetRequestAuthorizationDetails in the same Region to examine evaluated action and resource pairs and policy outcomes. An ID is not guaranteed for every denial.
AWS labels Access Troubleshooter with authorization IDs as a public preview and says recorded authorization details are retained for 24 hours after a denial. Check the live AWS documentation for current availability and behavior before relying on this diagnostic path.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
A practical order for diagnosis
- Locate the failing step. Determine whether the error occurs during the STS role-assumption request or during a later AWS service operation.
- If STS denied the request, inspect the role trust policy. Verify the registered provider, federated principal ARN, and
sts:AssumeRoleWithWebIdentityaction. - Compare token claims with trust conditions. Check the workflow’s actual audience and subject against the policy’s
audandsubvalues. - If a service call failed after credentials were obtained, inspect its authorization. Match the exact action and resource to the role’s allowed permissions, then check conditions, explicit denies, boundaries, and other applicable controls.
- If the denial includes an authorization ID, check whether AWS’s documented diagnostic flow supports the request and Region.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
