Upgrading from v5 to v6 breaks OIDC role assumption in reusable workflows

[pabloinigo]

Description

After upgrading from aws-actions/configure-aws-credentials v5 to v6, OIDC role assumption fails in reusable workflows with the error:

Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

The action retries 12 times with exponential backoff before failing. No changes were made to IAM trust policies or role configurations — the only change was the action version upgrade.

Setup

We use this action inside reusable workflows called from multiple repositories. The calling workflow has:

permissions:
  id-token: write
  contents: read

The reusable workflow invokes the action as:

- uses: aws-actions/configure-aws-credentials@v6
  with:
    role-to-assume: arn:aws:iam::<account-id>:role/<role-name>
    aws-region: eu-west-1
    role-duration-seconds: 3600
    audience: sts.amazonaws.com

Steps to reproduce

1. Have a working setup using aws-actions/configure-aws-credentials@v5 with OIDC inside a reusable workflow
2. Upgrade to aws-actions/configure-aws-credentials@v6
3. Run the workflow — OIDC role assumption fails

Expected behavior

Role assumption via OIDC should work the same as v5 without requiring changes to IAM trust policies.

Actual behavior

The action logs "Assuming role with OIDC" 12 times (retry mechanism) and then fails with:

Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

Logs

2026-03-25T15:54:06.8567018Z Assuming role with OIDC
2026-03-25T15:54:07.2147151Z Assuming role with OIDC
2026-03-25T15:54:07.3317433Z Assuming role with OIDC
... (12 retries with exponential backoff)
2026-03-25T15:56:41.3430774Z ##[error]Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

Environment

• Runner: ubuntu-24.04
• Working version: aws-actions/configure-aws-credentials@v5 (node20)
• Broken version: aws-actions/configure-aws-credentials@v6 (node24)
• Context: Action is called inside a reusable workflow (uses: org/repo/.github/workflows/plan.yml@tag)

Questions

1. Did v6 change anything about how the OIDC token is requested or its claims (e.g., sub, aud)?
2. Are there required changes to IAM trust policies when upgrading from v5 to v6?
3. Is there a known issue with v6 and reusable workflows specifically?

[lehmanmj]

Hi, I was unable to reproduce this behavior; I set up a reusable workflow which calls configure-aws-credentials v5 with OIDC and it worked even when I upgraded the action to v6.

To answer your questions,

1. The only change from v5 to v6 related to OIDC applies to role chaining. If your reusable workflow isn't using role-chaining: true, it shouldn't be affected.
2. No, there shouldn't be.
3. No.

Have you tried downgrading the version of the reusable workflow to v5 and seeing if it still works?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.