AWS, GitHub Action: User is not authorized to perform: sts:AssumeRole on resource(CodePipeline)

user_17450545 0
Viewed 2087

I hope some help from AWS Experts. I'm going to execute the AWS CodePipeline using GitHub Actions. I'm following this example and I already set the roles for this. But when I test it, there is an error like this.

"Error: User: arn:aws:iam:::user/lms-test is not authorized to perform: sts:AssumeRole on resource: arn:aws:codepipeline:us-west-1::lms-test"

To fix this error, I also added sts:AssumRole to current user(lms-test), but still same error. I look forward to getting solution about this problem.

Thanks for your time and consideration.

github-actions amazon-web-services github
1 Answers

Theres something missing in your trusted policy. Change it as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxxxxxxxxx:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:[your-org]/[your-repo]:*"
                }
            }
        }
    ]
}
user_100784330
Related