Cross account assume role using IAM Credentials

[lkashef]

I tried following this example but it keeps retrying and eventually fail with the message:

Could not assume role with user credentials: User: arn:aws:iam::***:user/*** is not authorized to perform: sts:TagSession on resource: ***

The user supposedly has the right permissions as it worked properly from my terminal using the same IAM Credentials and also worked okay with a workflow that uses aws-cli, I will post both files for reference:

name: 'Deploy to AWS CloudFormation'

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-22.04
    steps:

    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.CI_AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.CI_AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1
        role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN_STAGING }}
        role-duration-seconds: 1200
        role-session-name: GitHubActions

name: 'Deploy to AWS CloudFormation'

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-22.04
    steps:

    - name: Install & Configure AWS CLI
      run: |
        sudo apt-get install awscli
        aws configure set aws_access_key_id ${{ secrets.CI_AWS_ACCESS_KEY_ID }}
        aws configure set aws_secret_access_key ${{ secrets.CI_AWS_SECRET_ACCESS_KEY }}
        aws configure set default.region us-east-1

    - name: Assume Role
      run: |
        TEMP_ROLE=$(aws sts assume-role --role-arn ${{ secrets. CI_AWS_ROLE_ARN_STAGING }} --role-session-name GitHubActions)
        export AWS_ACCESS_KEY_ID=$(echo $TEMP_ROLE | jq -r .Credentials.AccessKeyId)
        export AWS_SECRET_ACCESS_KEY=$(echo $TEMP_ROLE | jq -r .Credentials.SecretAccessKey)
        export AWS_SESSION_TOKEN=$(echo $TEMP_ROLE | jq -r .Credentials.SessionToken)

[lkashef]

Turned out it was a permission issue. it worked using AWS CLI because my command didn't configure session tagging and the user didn't have the sts:TagSession but it did have sts:AssumeRole. adding both fixed the issue

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[prateekg1703]

We could have alternatively used role-skip-session-tagging: true provided by the action to skip session tagging. This would have eliminated the need to update the IAM user.