Not authorized to perform: sts:TagSession on resource: ***

Question

I'm trying to run a GitHub action to do a DB migration on AWS on staging server.

name: db migration for stg.

on:
  push:
    branches:
      - staging
    paths:
      - api/db/migrate/**

jobs:
  migration:
    name: DB Migration
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Configure AWS credentials
    uses: aws-actions/configure-aws-credentials@v1
    with:
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN_STG }}
      role-duration-seconds: 1200
      aws-region: ap-northeast-1
     - uses: ruby/setup-ruby@v1
     with:
      ruby-version: '2.7.2'
     - name: ssh configure
       env:
         SSH_SECRET_KEY: ${{ secrets.SSH_SECRET_KEY }}
       run: |
         mkdir -p ~/.ssh && touch ~/.ssh/config
         echo 'host i-* mi-*' >> ~/.ssh/config
         echo '  ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession --parameters 'portNumber=%p'"' >> ~/.ssh/config
         echo $SSH_SECRET_KEY | base64 -d > ~/.ssh/id_rsa2
         chmod 0600 ~/.ssh/id_rsa2
      - name: db migration
        env:
          RAILS_ENV: 
          RAILS_MASTER_KEY: 
          RDS_HOSTNAME: 127.0.0.1
          RDS_DB_NAME: 
          RDS_USERNAME: 
          RDS_PASSWORD: 
          RDS_PORT: 9999
          STEP_SERVER_ID: 
          DB_HOST: 
          working-directory: ./api
          run: |
            ssh -f -N -L $RDS_PORT:$DB_HOST:3306 -i ~/.ssh/id_rsa2 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ssm-user@$STEP_SERVER_ID
            sudo apt-get -yqq install libpq-dev
            gem install bundler
            bundle install --jobs 4 --retry 3
            bundle exec rails db:migrate

What might be the reason im getting this error when running this action? Tried many number of steps to narrow down the reason for the issue, whether its causing by the assumable_role or secret value errors or trust relationships etc.. Can suggest what might be causing this?

Run aws-actions/configure-aws-credentials@v1
 with:
  aws-access-key-id: ***
  aws-secret-access-key: ***
  role-to-assume: ***
  role-duration-seconds: 1200
  aws-region: ap-northeast-1

Error: User: arn:aws:iam::***:user/github_user is not authorized to perform: sts:TagSession on resource: ***

Policy summary of the github_user

{
  "Version": "2012-10-17",
  "Statement": [
     {
        "Effect": "Allow",
        "Action": "sts:*",
        "Resource": "*"
     }
   ] 
}

user_9990469 · Answer

I figured this out.
The answer is there very subtly in the documentation, but you have to give the user the permission for sts:TagSession and then add that same permission to the permissions policy of the role that you are assuming.

IAM User Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
            ],
            "Resource": [
                "arn:aws:iam::11111111111:role/RoleToAssume",
   
            ]
        }
    ]
}

Trust Relationship on role that is being assumed

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::00000000000:user/UserFromAbove"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ]
    }
  ]
}

user_13247931 · Answer

Adding to Chris which helped obviously to solve this issue:

When you have created the role using OIDC. It has a trust relationship. This means some Github Actions would have to be added to it as principle and it will assume that role and whatever permission this role has will be applied to federated OIDC identity Federated": "arn:aws:iam::636521895949:oidc-provider/token.actions.githubusercontent.com" in this case - Github Actions.
In addition, The User has to be there to provide short-lived tokens using AWS STS, so GitHub actions can assume that role. So, Principal": {"AWS": "arn:aws:iam::636527382793:user/" should have "Action": "sts:AssumeRole".
This means the Trust relationship on role can look like this as putting actions in a list is not allowed Action": ["sts:AssumeRole", "sts:TagSession"]: Lets call this role s3RoleForGitHubActions

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::6363891738271:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:github.com/GitHubProfile/GithubRepo/*"
                }
            }
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "AWS: "arn:aws:iam::6365738978321:user/UserName"
            },
            "Action": "sts:AssumeRole"
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::6365738978321:user/UserName"
            },
            "Action": "sts:TagSession"
        }
    ]
}

Finally, We need to provide the IAM User a policy that will allow itself to assume that role we created, so The IAM user policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
            ],
            "Resource": [
                "arn:aws:iam::63738127982:role/s3RoleForGitHubActions"
            ]
        }
    ]
}

Not authorized to perform: sts:TagSession on resource: ***

2 Answers