OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint

Question

- name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@master
        with:
          role-to-assume: ${{secrets.ARN_GITHUB_ACTIONS_ROLE_UAT}}
          aws-region: ${{secrets.AWS_REGION}}

Here is where I got the error and I don't have access to access cloud trails to see the history,it's possible that someone changed the credentials or delete the role?

Atchley

Answer 1

Note that GitHub (accidentally) updated their thumbprint recently, so the result is now 6938fd4d98bab03faadb97b34396831e3780aea1

More details here https://github.blog/changelog/2022-01-13-github-actions-update-on-oidc-based-deployments-to-aws/

Emmalynne

Answer 2

There was a new change in the thumbprints, take a look at this blog post:

https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/

Customers experiencing issues authenticating via OIDC with AWS should configure both thumbprints to be trusted in the AWS portal.
The two known intermediary thumbprints at this time are:

6938fd4d98bab03faadb97b34396831e3780aea1
1c58a3a8518e8759bf075b76b750d4f2df264fcd

Rung

Answer 3

You shuld update your Thumbprints in AWS. In this link you can find how to create your thumbprints. Obtaining the thumbprint for an OpenID Connect Identity Provider. After that

• Go to your IAM Identity Providers
• Choos your provider
• Manage Thumbprints
• Update the thumbprint with the one you optaind following the Obtaining the thumbprint for an OpenID Connect Identity Provider

Essequibo