OpenIDConnect 提供商的 HTTPS 证书与配置的指纹不匹配

Question

- name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@master
        with:
          role-to-assume: ${{secrets.ARN_GITHUB_ACTIONS_ROLE_UAT}}
          aws-region: ${{secrets.AWS_REGION}}

Here is where I got the error and I don't have access to access cloud trails to see the history,it's possible that someone changed the credentials or delete the role?

Answer 1

You shuld update your Thumbprints in AWS. In this link you can find how to create your thumbprints. Obtaining the thumbprint for an OpenID Connect Identity Provider . After that

• Go to your IAM Identity Providers
• Choos your provider
• Manage Thumbprints
• Update the thumbprint with the one you optaind following the Obtaining the thumbprint for an OpenID Connect Identity Provider

Answer 2

Note that GitHub (accidentally) updated their thumbprint recently, so the result is now 6938fd4d98bab03faadb97b34396831e3780aea1

More details here https://github.blog/changelog/2022-01-13-github-actions-update-on-oidc-based-deployments-to-aws/