Error: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint while connecting AWS & github actions

[kamranNBS]

Error: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint

I am using thumbprint : 6938fd4d98bab03faadb97b34396831e3780aea1

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::XXXXXXXXXXX:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": [
                "sts:AssumeRoleWithWebIdentity"
            ],
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:sub": "repo:XXXXX/*"
                },
                "ForAllValues:StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
                    "token.actions.githubusercontent.com:iss": "https://token.actions.githubusercontent.com"
                }
            }
        }
    ]
}

type: OpenID Connect
provider: https://token.actions.githubusercontent.com/
thumbprint : 6938fd4d98bab03faadb97b34396831e3780aea1
Audience: sts.amazonaws.com

[LisaElaine]

I am having the same issue, have you sorted this out?

[mchineboy]

It appears that the cert changed. Trying to get a new thumbprint isn't working for me:

https://gist.github.com/guitarrapc/8e6b68f21bc1eef8e7b66bde477d5859?permalink_comment_id=4027755

[russ-marcie]

Updating our IAM identity configuration to include both fingerprints listed in this post has resolved the issue for us: https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/

[peterwoodworth]

Hey all, please see #357 for the main thread where this has been discussed. We've recently updated the readme as well to include the new thumbprint.

[peterwoodworth]

Specifying the right thumbprint isn't necessary anymore - please see #357 (comment) for more info

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.