From 25b425a690836e4f0a875e9c343d956f3b5af088 Mon Sep 17 00:00:00 2001 From: MaxThePrisberry Date: Wed, 16 Sep 2026 16:19:43 -0600 Subject: [PATCH 1/4] Teach the trust policy subject that GitHub now sends The role wizard builds the subject claim from names alone. GitHub adds immutable account and repository IDs for anything created after July 15, 2026, so the deploy fails with "Not authorized to perform sts:AssumeRoleWithWebIdentity". Students now set the subject with both IDs, under StringLike, since StringEquals treats the trailing wildcard as a literal character. --- .../awsS3Deployment/awsS3Deployment.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/instruction/awsS3Deployment/awsS3Deployment.md b/instruction/awsS3Deployment/awsS3Deployment.md index 9b28ce0b..264bda3a 100644 --- a/instruction/awsS3Deployment/awsS3Deployment.md +++ b/instruction/awsS3Deployment/awsS3Deployment.md @@ -111,6 +111,37 @@ Now, create the IAM role that GitHub Actions will assume. 1. Name the role `github-ci`. 1. Click **Create role**. +### Set the trust policy subject + +The role wizard writes the subject claim using your account and repository names alone. GitHub also includes immutable numeric IDs in that claim for every repository created after July 15, 2026, and for any account or repository renamed after that date. Without the IDs the claim will not match and your deployment fails with `Not authorized to perform sts:AssumeRoleWithWebIdentity`. + +Find both IDs by opening the following URL in your browser, replacing `YOURGITHUBACCOUNT` with your GitHub account name. + +```txt +https://api.github.com/repos/YOURGITHUBACCOUNT/jwt-pizza +``` + +The repository ID is the `id` field at the top. Your account ID is the `id` field inside `owner`. + +1. In the IAM console, open the `github-ci` role. +1. Select the **Trust relationships** tab and click **Edit trust policy**. +1. Replace the `Condition` object with the following, filling in your account name, account ID, and repository ID. + + ```json + "Condition": { + "StringEquals": { + "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" + }, + "StringLike": { + "token.actions.githubusercontent.com:sub": "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza@JWTPIZZAREPOID:*" + } + } + ``` + +1. Click **Update policy**. + +The subject has to sit under `StringLike` rather than `StringEquals`, because `StringEquals` treats the trailing `*` as a literal character and never matches. That wildcard covers whichever branch or environment the workflow runs under. Both IDs stay the same even if you rename your account or your fork. + ### Configure GitHub Actions The final step is to create a GitHub Actions workflow that deploys to S3 using the OIDC credentials. From d75b2a2527c96cc1aac93779a65426b44688358f Mon Sep 17 00:00:00 2001 From: MaxThePrisberry Date: Wed, 16 Sep 2026 16:19:43 -0600 Subject: [PATCH 2/4] Update the environment trust policy to the ID subject The policy here matched on names, which no longer works for forks created after July 15, 2026. The new subject ends with a wildcard, so it also covers the environment:production claim this page adds, and the separate environment entry is gone. --- instruction/gitHubEnvironments/gitHubEnvironments.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/instruction/gitHubEnvironments/gitHubEnvironments.md b/instruction/gitHubEnvironments/gitHubEnvironments.md index c8cd83a4..a9c7ab87 100644 --- a/instruction/gitHubEnvironments/gitHubEnvironments.md +++ b/instruction/gitHubEnvironments/gitHubEnvironments.md @@ -53,7 +53,7 @@ For your CI workflow to access AWS using the IAM role you created previously, yo 1. Open the **IAM dashboard** in the AWS Console. 2. Locate and edit the `github-ci` role. -3. Update the `Condition` object in the **Trust relationship** to include the `environment:production` string in the `sub` (subject) claim. +3. Confirm the `Condition` object in the **Trust relationship** matches the following. The wildcard at the end of each subject already covers the `environment:production` claim that your workflow sends once it runs in the production environment. ```json { @@ -67,11 +67,12 @@ For your CI workflow to access AWS using the IAM role you created previously, yo "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { - "token.actions.githubusercontent.com:aud": "sts.amazonaws.com", + "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" + }, + "StringLike": { "token.actions.githubusercontent.com:sub": [ - "repo:YOURGITHUBACCOUNTNAME/jwt-pizza:environment:production", - "repo:YOURGITHUBACCOUNTNAME/jwt-pizza:ref:refs/heads/main", - "repo:YOURGITHUBACCOUNTNAME/jwt-pizza-service:ref:refs/heads/main" + "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza@JWTPIZZAREPOID:*", + "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza-service@JWTPIZZASERVICEREPOID:*" ] } } From 033f848b47dddf230a7d136a0cf45091eee9d9db Mon Sep 17 00:00:00 2001 From: MaxThePrisberry Date: Wed, 16 Sep 2026 16:19:43 -0600 Subject: [PATCH 3/4] Add the service repository with the ID subject format This step replaced the whole subject condition with name-only entries, which would have undone the IDs set in the S3 deployment instruction. It now extends the StringLike condition with both repositories. --- instruction/awsEcr/awsEcr.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/instruction/awsEcr/awsEcr.md b/instruction/awsEcr/awsEcr.md index 42a651e4..48eef252 100644 --- a/instruction/awsEcr/awsEcr.md +++ b/instruction/awsEcr/awsEcr.md @@ -45,12 +45,14 @@ In order for the `jwt-pizza-service` CI workflow to make requests over the OIDC- 1. Select the `github-ci` role that you created when you set up `jwt-pizza` to deploy to S3. 1. Select the **Trust relationships** tab. 1. Click **Edit trust policy**. -1. Replace the `token.actions.githubusercontent.com:sub` value with the following array. This allows both of your source repositories to make an OIDC connection. Replace `YOURGITHUBACCOUNTHERE` with your actual GitHub username. +1. Replace the `StringLike` condition with the following so that both of your source repositories can make an OIDC connection. Fill in your account name and account ID, and the repository ID of each fork. You can read each one from `https://api.github.com/repos/YOURGITHUBACCOUNT/jwt-pizza` and `https://api.github.com/repos/YOURGITHUBACCOUNT/jwt-pizza-service`. ```json - "token.actions.githubusercontent.com:sub": [ - "repo:YOURGITHUBACCOUNTHERE/jwt-pizza:ref:refs/heads/main", - "repo:YOURGITHUBACCOUNTHERE/jwt-pizza-service:ref:refs/heads/main" - ], + "StringLike": { + "token.actions.githubusercontent.com:sub": [ + "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza@JWTPIZZAREPOID:*", + "repo:YOURGITHUBACCOUNT@YOURACCOUNTID/jwt-pizza-service@JWTPIZZASERVICEREPOID:*" + ] + }, ``` 1. Click the **Update policy** button. From 5cf702fed552476d66d735cc81908133bdaa2ebb Mon Sep 17 00:00:00 2001 From: MaxThePrisberry Date: Wed, 16 Sep 2026 16:19:43 -0600 Subject: [PATCH 4/4] Correct the trust relationship recovery steps The section applied only to renamed accounts, but every fork created after July 15, 2026 carries the ID subject. It now also covers roles created before the S3 instruction taught it, reads both IDs from one API page, and puts the subject under StringLike. The example also had two typos, "re:refs/heads" and "refs/head/main". --- instruction/faq/faq.md | 48 ++++++++++++++---------------------------- 1 file changed, 16 insertions(+), 32 deletions(-) diff --git a/instruction/faq/faq.md b/instruction/faq/faq.md index 5ae8a2a6..d57371e8 100644 --- a/instruction/faq/faq.md +++ b/instruction/faq/faq.md @@ -73,48 +73,32 @@ If you can do this, then you know your database is working, your username and pa ### Updating Trust Relationship -In the rare case you have changed your GitHub username, you'll need to update the `Trust relationship` for your IAM role. +If your IAM role was created before the [S3 deployment instruction](../awsS3Deployment/awsS3Deployment.md#set-the-trust-policy-subject) began setting repository IDs, or you have renamed your GitHub account or your fork since, the `Trust relationship` for your IAM role needs updating. -If you currently deploy, you'll see an error in the `Create OIDC token to AWS` +You will see this error in the `Create OIDC token to AWS` step: ```Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity``` This is because GitHub includes stable numeric IDs in the subject claim to prevent future impersonation if the old username is ever reclaimed by someone else. -In order to fix this, you'll need to add the following to Trust relationship of your IAM Role. +Find both IDs by opening the following URL in your browser, replacing `YOURACCOUNTHERE` with your GitHub account name. -1. Your GitHub account ID -1. Your `jwt-pizza` repository ID +- https://api.github.com/repos/YOURACCOUNTHERE/jwt-pizza -#### GitHub Id +The repository ID is the `id` field at the top of the page. Your account ID is the `id` field inside `owner`. -1. Go to the following URL and replace YOURACCOUNTHERE with your current GitHub account (i.e. byucsstudent) -- https://api.github.com/users/YOURACCOUNTHERE -2. From there, find the "id" section and copy it. -- i.e. ```"id": 159643410``` +With both IDs, go to AWS -> IAM -> Roles. Open your role (i.e. `github-ci`), select `Trust relationships`, and click `Edit trust policy`. The subject claim needs to carry both IDs, and it has to sit under `StringLike` rather than `StringEquals`, because `StringEquals` treats the trailing `*` as a literal character and never matches. -#### Repository ID - -1. Go to your `jwt-pizza` repository on GitHub and on the main page (i.e. https://github.com/byucsstudent/jwt-pizza) -1. Right click and select `View page source` -1. Use Ctrl-F to and find "repository:" -1. Copy the 10-digit ID that is in the meta tag -- `````` - -#### Updating Trust Relationship - -With both IDs, go to AWS -> IAM -> Roles. Go to the recently created role (i.e. `github-ci`). Then navigate to `Trust relationships`. - -In the JSON, look for the section called `StringEquals`, specifically in the `token.actions.githubusercontent.com:sub` section. -The current format follows `repo:OWNER/REPO:ref:refs/heads/BRANCH`. - -Click `Edit trust policy`. - -You need to include your GitHub id and repository id to these sections so it appears like this - -`repo:owner@id/repo@repo-id:re:refs/heads/BRANCH` - -Example: `repo:byucsstudent@159643410/jwt-pizza@1355254320:ref:refs/head/main` +```json +"Condition": { + "StringEquals": { + "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" + }, + "StringLike": { + "token.actions.githubusercontent.com:sub": "repo:byucsstudent@159643410/jwt-pizza@1355254320:*" + } +} +``` Click `Update policy`.