Instance profile assume Role issue

[abhisharma-mcd]

Hi, I'm using this action in a workflow which is running on a self-hosted runner. Runner is configured on AWS EC2 instance which has instance profile attached. When I run the worklfow, I'm getting below issue :-

As you can see, instance profile that is attached to runner server is trying to assume the role that is passed to the action instead of Access and Secret key of user.

Below is the workflow code :-

name: 'est worklfow'
on: 
  workflow_dispatch:
jobs: 
  test-job:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v1
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_KEY_ID }}
          aws-region: us-east-1
          role-to-assume: arn:aws:iam::111111111111:role/TEST_ROLE
          role-duration-seconds: 1200
          role-skip-session-tagging: true
      
      - name: Check S3 access
        run: aws s3 ls

Any idea why is it happening and how to fix it?

[abatilo]

I've been seeing this intermittently also, but not sure why

[dnascimento]

I'm having the same issue. Could the aws-access-key-id have precedence over the IAM role?

[YorickH]

Hey @abhisharma-mcd Try setting the correct permissions for the job: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings

This fixed this issue for me

[peterwoodworth]

It appears the workflow code pasted, and the screenshot differ in terms of configuration. Is this being attempted with OIDC, or with regular AssumeRole?

[shulyakav]

If you have this part in your job,

permissions:
  id-token: write

GH Actions runners think that you are using ODIC ( Even if it is not true) and you cannot assume a role.

Fix - remove "permissions for token"

[peterwoodworth]

This action shouldn't attempt to use OIDC if you have properly setup your inputs https://github.com/aws-actions/configure-aws-credentials#assuming-a-role

[github-actions[bot]]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.