GitHub Changed Its OIDC Subject Claims — and Broke My AWS Deploys for New Repos

How a trust policy that worked for every existing repo failed for a brand-new one, how I tracked it down through CloudTrail, and what you should change in your AWS OIDC trust policies today.

Disclaimer: This post focuses on diagnosing a breaking issue in our AWS OIDC integration with GitHub Actions, not on establishing configuration best practices. The trust policy examples below use wildcards for active troubleshooting and illustrative purposes — these should be scoped appropriately to match your specific GitHub repository branch/environment and AWS environment before use in production.

TL;DR

GitHub has started issuing OIDC tokens with a new subject (sub) claim format for newly created repositories. The classic format:

repo:my-org/my-repo:ref:refs/heads/main