OpenID Connect提供程序的HTTPS证书与配置的Thumbprint不匹配。

Question

- name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@master
        with:
          role-to-assume: ${{secrets.ARN_GITHUB_ACTIONS_ROLE_UAT}}
          aws-region: ${{secrets.AWS_REGION}}

这是我遇到错误的地方，但我无法访问Cloud Trails来查看历史记录。有可能是有人更改了凭据或删除了角色吗？

- Hulubina

Answer 1

有一个新的变化在指纹上，快来看看这篇博客文章：

https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/

Customers experiencing issues authenticating via OIDC with AWS should configure both thumbprints to be trusted in the AWS portal.
The two known intermediary thumbprints at this time are:

6938fd4d98bab03faadb97b34396831e3780aea1
1c58a3a8518e8759bf075b76b750d4f2df264fcd

- Luan Kevin Ferreira

Answer 2

请注意，GitHub最近（意外地）更新了他们的指纹，因此结果现在是6938fd4d98bab03faadb97b34396831e3780aea1。

更多细节请参见https://github.blog/changelog/2022-01-13-github-actions-update-on-oidc-based-deployments-to-aws/。

- Carlos Santini

Answer 3

您应该更新AWS中的Thumbprints。您可以在此链接中找到如何创建Thumbprints的方法：获取OpenID Connect身份提供程序的Thumbprint。之后，

• 进入您的IAM身份提供者
• 选择您的提供商
• 管理Thumbprints
• 使用您按照“获取OpenID Connect身份提供程序的Thumbprint”所获得的Thumbprint更新Thumbprint

- manukyanv07