By using AWS re:Post, you agree to the AWS re:Post Terms of Use

Error: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint while connecting github actions to AWS using IAM role based authentication

0

Error: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::XXXXXXXXXXX:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": [
                "sts:AssumeRoleWithWebIdentity"
            ],
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:sub": "repo:XXXXX/*"
                },
                "ForAllValues:StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
                    "token.actions.githubusercontent.com:iss": "https://token.actions.githubusercontent.com"
                }
            }
        }
    ]
}
type: OpenID Connect
provider: https://token.actions.githubusercontent.com/
thumbprint : 6938fd4d98bab03faadb97b34396831e3780aea1
Audience: sts.amazonaws.com
profile picture
asked a year ago1.7K views
3 Answers
0
profile picture
EXPERT
answered a year ago
profile picture
EXPERT
reviewed a year ago
0

However the key was same but now its giving me..

Error: Not authorized to perform sts:AssumeRoleWithWebIdentity. please refer to my pain post I have already provided these rights.

profile picture
answered a year ago
0

The following blog may be related to this issue if it has not already been resolved.
Try setting two keys according to the documentation.
https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/

Customers experiencing issues authenticating via OIDC with AWS should configure both thumbprints to be trusted in the AWS portal. The two known intermediary thumbprints at this time are:

6938fd4d98bab03faadb97b34396831e3780aea1
1c58a3a8518e8759bf075b76b750d4f2df264fcd

profile picture
EXPERT
answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions