← Problem Library
CI/CD L7 CICD-032 · 28 min

OIDC subject condition mismatch denies AWS deploy role assumption

GitHub Actions reaches AWS STS, but the trust policy rejects the web identity token because the subject or audience condition no longer matches the branch and environment path.

CI/CDPlatform ReliabilityLevel 7Pro28 min
Scenario

GitHub Actions reaches AWS STS, but the trust policy rejects the web identity token because the subject or audience condition no longer matches the branch and environment path.

What to check first
  • Identify the primary failure signal in the OIDC Federation Debug scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Choose the smallest safe recovery action first, then record the prevention work that reduces repeat incidents.

Questions worth viewing together
What usually causes OIDC deploy-role failure after workflow refactoring?

The token subject changed, but the trust policy still matches the old repository or branch pattern.