GitHub OIDC Trust Both Sub Shapes
github-oidc-trust-both-sub-shapes · always_apply: yes
Content
GitHub Actions OIDC sub claims come in two shapes: name-only repo:{org}/{repo}:* and ID-qualified repo:{org}@{ORG_ID}/{repo}@{REPO_ID}:ref:.... The deploy IAM role must trust both. Trusting only the name-only pattern causes AssumeRoleWithWebIdentity to fail on main pushes.
Details
- Slug:
github-oidc-trust-both-sub-shapes- Always apply:
- Yes
- Created:
- Sep 15, 2026
- Updated:
- Sep 15, 2026
Playbook
Activities 2
- Model the Data Lake as CDK Stacks Model and Deploy Infrastructure as Code
- Deploy via GitHub Actions Model and Deploy Infrastructure as Code