GitHub Actions OIDC "audience" mismatch on cloud login

By Daniel Zoghalchali·Latchkey

When you override the OIDC audience with a custom value, the cloud provider trust policy must accept exactly that audience. A mismatch causes the federated assume-role to be rejected. This is a config error, not transient.

What this error means

The login step fails with an audience or claim validation error after a custom audience input was supplied to getIDToken or the action.

Error: AssumeRoleWithWebIdentity failed: Incorrect token audience
expected 'sts.amazonaws.com' but token presented 'my-custom-aud'

Common causes

Custom audience input not mirrored in trust policy

A custom audience override on the workflow side is not reflected in the provider/role trust condition.

Provider audience list omits the value

The OIDC provider client-id-list does not contain the audience the token carries.

How to fix it

Match audience on both sides

1. Decide on one audience value and use it consistently.
2. Set the same value in the provider client-id-list and the role trust StringEquals aud condition.
3. If you do not need a custom audience, remove the override and use the provider default.

# Workflow side: omit audience to use the default, or set it explicitly
- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
    aws-region: us-east-1
    audience: sts.amazonaws.com

How to prevent it

• Avoid custom audiences unless a provider requires one.
• Keep the audience value defined in exactly one place in IaC and reference it.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions