GitHub Actions OIDC to AWS fails with 'Not authorized to perform sts:AssumeRoleWithWebIdentity' in aws-actions/configure-aws-credentials. What do I check?

Cause: AWS rejected the OIDC token GitHub issued because the IAM role's trust policy did not match it, or no token was issued. The usual culprits are a sub claim that does not match the trust policy, a wrong audience, a missing id-token permission, or a missing identity provider. Fix: 1. Give the job permission to request a token: permissions: id-token: write (and contents: read if you use checkout). This does not grant write access to resources. 2. Confirm the IAM identity provider exists with URL https://token.actions.githubusercontent.com and the audience sts.amazonaws.com. 3. In the role's trust policy, set the condition on token.actions.githubusercontent.com:aud to sts.amazonaws.com, and a condition on :sub that matches how the workflow runs: branch form repo:ORG/REPO:ref:refs/heads/BRANCH, or environment form repo:ORG/REPO:environment:NAME when the job uses an environment (the subject differs, so a branch-only policy fails). Repositories using immutable IDs have a different subject format with org and repo ids, so compare against the actual token. 4. Do not "fix" it by wildcarding everything; a StringLike of repo:ORG/REPO:* allows any branch, PR or environment in that repo, and having no sub condition lets other repositories assume the role. Keep conditions as narrow as the use case allows. 5. Check role-to-assume is the exact ARN of the role carrying that trust policy, and aws-region is set. Pull requests from forks get no usable token by design. 6. To see what GitHub actually sent, compare the sub in your trust policy with the subject documented for your trigger (branch, tag, pull_request, environment); mismatch is the most frequent cause. Verify: the configure-aws-credentials step succeeds and "aws sts get-caller-identity" in the next step shows the assumed role. Sources: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax