GitHub Actions error: No OpenIDConnect provider found in your account for https://token.actions.githubusercontent.com

Question

Here is the relevant portion of the yml file I'm using for GitHub Actions:

jobs:
  AssumeRoleAndCallIdentity:
    runs-on: ubuntu-latest
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ secrets.AWS_REGION }}

This results in the following error in the GitHub Actions console:

Run aws-actions/configure-aws-credentials@v1
Error: No OpenIDConnect provider found in your account for https://token.actions.githubusercontent.com

However, I DO have an OpenIDConnect provider configured in AWS for token.actions.githubusercontent.com, and I have associated that identity provider in a trust relationship with the Role I'm using.

What could the problem be?

Answer 1

Turns out Identity Providers in AWS IAM are case sensitive! My Identity Provider was named like token.actions.GitHubusercontent.com because I copypasta'd from the AWS documentation for connecting GitHub Actions to AWS (see screenshot below).

This doesn't work because it has different casing than what is expected by GitHub, which is token.actions.githubusercontent.com.

Answer 2

Another cause for the error

I'll provide another cause for this error for those who reach this question after searching on the error in the title:

No OpenIDConnect provider found in your account for https://token.actions.githubusercontent.com

So the reason can be exactly like the error specify:
You don't have an OpenIDConnect provider in your account that is realted to Github actions.

The offical docs can be very implicit about this.

In the following AWS article: Configuring OpenID Connect in Amazon Web Services most of the details are kind of assuming that the reader already created the OpenIDConnect provider and is more focusing on how to configure the role, trust policy and the requirements in the Github action side.

How do you I know if I have an OpenIDConnect provider in my account?

Go the IAM console and check under "Identity providers".

How do I create an OIDC provider in AWS - Console and CLI

Under the section of configuring openid connect in amazon web services there is a reference to the AWS article on how to Create an OpenID Connect (OIDC) identity provider in IAM.

How do I create an OIDC provider in AWS - Terraform

You can use the aws_iam_openid_connect_provider resource.

But in order to avoid issues like OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint, try not to setup hardcoded values in the thumbprint list - like in the following snippet:

data "tls_certificate" "github" {
  url = "https://token.actions.githubusercontent.com/.well-known/openid-configuration"
}

resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  thumbprint_list = [data.tls_certificate.github.certificates[0].sha1_fingerprint]
  client_id_list  = ["sts.amazonaws.com"]
}