configure-aws-credentials: Could not load credentials from any providers

so i think there is an undocumented permissions thing you need to use in your workflow to get it

permissions:
  id-token: write
  contents: read

try that

seems to be true about defining the permissions for the configuration step.

if you follow https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services it will help

I was having the same issue after pushing 20 commits to try different things it worked 😅

The steps:

1. Configure the Identity Provider in the IAM AWS console (use the info in the link)
2. Create a new role that includes the identity provider <---- important
3. Define the permissions in your YAML file (like below)
4. Add the role’s ARN (not the OIDC arn) to the configuration step in the YAML

name: AWS Lambda

on:
  workflow_dispatch:
  push:
    branches: [ main ]
permissions:
      id-token: write
      contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:....

@richardhboyd ok, I saw your last commit yesterday so I have tried using aws-actions/configure-aws-credentials@master, sigstore as audience and add the permissions suggested by @androidwiltron and it is working.

I think we should implement the (2)

EDIT: minor correction in the permissions since I am using semantic-release:

permissions:
  id-token: write
  contents: write

GitHub have now formally released OpenID Connect

• https://github.blog/changelog/2021-10-27-github-actions-secure-cloud-deployments-with-openid-connect/ and
• https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services

So it would be good to have a new release version now, saves having to use @master or @shaXYZ.

If anyone needs it I wrote up a blog post on how to get it all working.

https://blog.tedivm.com/guides/2021/10/github-actions-push-to-aws-ecr-without-credentials-oidc/

I just got it running by having your setup, using aws-actions/configure-aws-credentials@b8c74de instead of v1/master and by adding sigstore to the list of audiences.

I’ve been able to reproduce this. I’m working with the GitHub team to root cause it. Our plan was to use the audience sts.amazonaws.com since that indicates who you intend to hand the JWT to. It appears that the ability to set an arbitrary audience hasn’t reached everywhere yet. I’m suggesting that we:

(1) roll this repo back to the version where the audience was hardcoded with sigstore for now

(2) I document in the repo’s readme the additional permissions that are needed

(3) I add a note to teh readme that this feature is still undergoing changes by GitHub

Thoughts?

One thing that is not obvious that I will leave here for anyone googling to resolve their problem is that job permissions do not individually overwrite workflow permissions, the new permissions block replaces the old permissions block. They are not merged.

This means that in this configuration:

permissions:
  id-token: write
  contents: read

jobs:
  build:
    name: build
    permissions:
      pull-requests: write

The build job will not have id-token: write nor contents: read as the effective permissions block for the job only grants pull-requests: write.

Personally I think that this perhaps might be a confusing design choice and that the job permissions should be deep merged into the workflow permissions, but this is how it works at the moment.

If your jobs have their own permissions applied, make sure to repeat id-token and contents.

I solved the problem by doing the following. Thank you.

https://github.com/aws-actions/configure-aws-credentials/issues/271#issuecomment-931012696 https://github.com/aws-actions/configure-aws-credentials/issues/271#issuecomment-931272443

I blogged in Japanese.

https://dev.classmethod.jp/articles/github-actions-configure-aws-credentials-oidc/

I don’t think a new release has been made since Jul 19 while OICD changes where merged two days ago. https://github.com/aws-actions/configure-aws-credentials/commit/b8c74de753fbcb4868bf2011fb2e15826ce973af

What happens if you change the version to master? uses: aws-actions/configure-aws-credentials@v1-> uses: aws-actions/configure-aws-credentials@master

I’m experiencing the exact same error too.

so i think there is an undocumented permissions thing you need to use in your workflow to get it

permissions:
  id-token: write
  contents: read

try that

Saved my day. Thanks man…

When will this feature be released (as it is implemented now on master branch)? Are you waiting for github to go GA with their workload OIDC?

Hi followed all the instructions provided by GitHub and in this thread by I’m still unable to load credentials.

Action YAML

name: Plan / Test On PR

on:
  pull_request:
    branches:
      - main

# These permissions are needed to interact with GitHub's OIDC Token endpoint.
permissions:
  id-token: write
  contents: read

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2

      - name: Run terraform fmt check
        run: terraform fmt -check -diff -recursive

  plan_and_apply:
    name: Plan and Apply
    runs-on: ubuntu-latest

    steps:
      - name: Check out code
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          role-to-assume: arn:aws:iam::423779874966:role/GitHubAction # The role ARN is correct.
          aws-region: eu-west-1
      - run: aws sts get-caller-identity

Provider configuration:

IAM Role trust configuration:

What am I doing wrong?

EDIT: the pipeline is failing on PR from an external fork

thank you so much @idelfonsog2, that fixed my issue, I was using the wrong role in my configuration step of my yaml!

@ohad-griiip the issues is because of the AWS provider configuration. Make sure you have this at the audience: sts.amazonaws.com

IAM > Identity providers > Github_provider > Audiences > Add audience > sts.amazonaws.com

Hi guys,

Still getting this error, my trust relationship:

  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::00000000000:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:ORG/REPO:*"
        }
      }
    }
  ]
}

And my github action:

jobs:
  deploy:
    name: Build and deploy backend
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: ${{ env.REGION }}
          role-to-assume: arn:aws:iam::00000000000:role/git-action-deployment-user
          role-session-name: GithubActionDeployment
...

And the identity provider audiences is:

sts.amazonaws.com
https://github.com/ORG/REPO

Getting the error:

Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers

EDIT: Never mind - I got it working using aws-actions/configure-aws-credentials@master

@androidwiltron re: “so i think there is an undocumented permissions thing you need to use in your workflow to get it”

it’s documented here https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#updating-your-github-actions-workflow

Thank you ! that fixed it, and then I’m onto https://github.com/aws-actions/configure-aws-credentials/issues/357 haha

When will this feature be released (as it is implemented now on master branch)? Are you waiting for github to go GA with their workload OIDC?

It looks like this was just released yesterday in v1.6.0: https://github.com/aws-actions/configure-aws-credentials/blob/v1.6.0/CHANGELOG.md#160-2021-11-23

@ahawkins change client_id_list = [ "sigstore" ] => to => client_id_list = [ "sts.amazonaws.com" ]

a codecommit repository? the ecr-public registries are reachable from any region but you have to use the us-east-1 endpoint to retrieve your token to authenticate.

https://stackoverflow.com/questions/69274998/could-not-connect-to-the-endpoint-url-https-api-ecr-public-xxxxxxxxx-amazona

Was getting this error until I set the environment value to match the Github environment that had all the secrets

    runs-on: ubuntu-latest
    environment:
      name: production

I encountered the same issue, but @androidwiltron 's suggestion resolved it. Thanks. https://github.com/aws-actions/configure-aws-credentials/issues/271#issuecomment-931012696

@kaihendry A lack of this may be the cause.

https://github.com/aws-actions/configure-aws-credentials/issues/271#issuecomment-931012696

Here is the official announcement: https://github.blog/2021-11-23-secure-deployments-openid-connect-github-actions-generally-available/

That’s not going to work. With OIDC connections you have to have a role as part of your initial connection. This is because that role is where permission is given permission to Github to hand out tokens. Without that permission you can’t do anything.

After you create an IAM OIDC identity provider, you must create one or more IAM roles. A role is an identity in AWS that doesn’t have its own credentials (as a user does). But in this context, a role is dynamically assigned to a federated user that is authenticated by your organization’s IdP. The role permits your organization’s IdP to request temporary security credentials for access to AWS.

One somewhat convoluted option would be to create a role with assume role permissions on other roles, so that one can be used to switch to the other, but I honestly can’t see a good reason to do that. I’d just create a role for each repository and then assume it directly.

Yep great it’s working 🚀 thanks a lot @tedivm !

@bryantbiggs Thank you! ❤️ That fixed it. Probably a good thing to call out in the docs related to #284 in a migration from v2 to v3.

Seems there are more issues with master. I’m using a token like:

permissions:
  id-token: write
  contents: write

And an IAM provider like:

resource "aws_iam_openid_connect_provider" "github" {
	url             = "https://token.actions.githubusercontent.com"
	client_id_list  = [ "sigstore" ]
	thumbprint_list = [ "a031c46782e6e6c662c2c87c76da9aa62ccabd8e" ]
}

data "aws_iam_policy_document" "assume_role_policy" {
	statement {
		sid     = "GrantGithubActionsAccess"
		effect  = "Allow"
		actions = [ "sts:AssumeRoleWithWebIdentity" ]
		condition {
			test     = "StringLike"
			variable = "token.actions.githubusercontent.com:sub"
			values   = [ "repo:REDACTED:*" ]
		}
		principals {
			type        = "Federated"
			identifiers = [ aws_iam_openid_connect_provider.github.id ]
		}
	}
}

This was working a few days ago. Now it errors with Incorrect token audience.

Has something changed in Github Actions itself?

EDIT: Fixed with https://github.com/aws-actions/configure-aws-credentials/issues/271#issuecomment-947983135

I blogged in Japanese.

https://dev.classmethod.jp/articles/github-actions-configure-aws-credentials-oidc/

Thanks a ton, @dyoshikawa You blog saves my day.

@chris3ware Just checked and the web editor does this to mine as well which works - GitHub just hasn’t updated their validation in the editor it looks like.

ecr-public is only available in us-east-1