fix: Update IAM Role Trust Policy to allow both main and deploy branches

Hirose-Sebastian-Taikai · Hirose-Sebastian-Taikai · commit a6701cc7f783 · 2025-07-31T11:32:19.000+09:00
- Change from StringEquals to StringLike for sub condition
- Allow both main and deploy branches in OIDC trust policy
- Fix 'Request ARN is invalid' error in GitHub Actions
- Update condition to use array format for multiple branch patterns
- Ensure proper OIDC authentication for multi-branch deployment
diff --git a/create_role.ps1 b/create_role.ps1
@@ -1051,8 +1051,13 @@ $TRUST_POLICY = @"
             "Action": "sts:AssumeRoleWithWebIdentity",
             "Condition": {
                 "StringEquals": {
-                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
-                    "token.actions.githubusercontent.com:sub": "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/deploy"
+                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+                },
+                "StringLike": {
+                    "token.actions.githubusercontent.com:sub": [
+                        "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/main",
+                        "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/deploy"
+                    ]
                 }
             }
         }
diff --git a/create_role.sh b/create_role.sh
@@ -1054,8 +1054,13 @@ TRUST_POLICY=$(cat <<EOF
             "Action": "sts:AssumeRoleWithWebIdentity",
             "Condition": {
                 "StringEquals": {
-                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
-                    "token.actions.githubusercontent.com:sub": "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/deploy"
+                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+                },
+                "StringLike": {
+                    "token.actions.githubusercontent.com:sub": [
+                        "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/main",
+                        "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/deploy"
+                    ]
                 }
             }
         }

Original file line number	Diff line number	Diff line change
`@@ -1051,8 +1051,13 @@ $TRUST_POLICY = @"`
`1051`	`1051`	`"Action": "sts:AssumeRoleWithWebIdentity",`
`1052`	`1052`	`"Condition": {`
`1053`	`1053`	`"StringEquals": {`
`1054`		`- "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",`
`1055`		`- "token.actions.githubusercontent.com:sub": "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/deploy"`
	`1054`	`+ "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"`
	`1055`	`+ },`
	`1056`	`+ "StringLike": {`
	`1057`	`+ "token.actions.githubusercontent.com:sub": [`
	`1058`	`+ "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/main",`
	`1059`	`+ "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/deploy"`
	`1060`	`+ ]`
`1056`	`1061`	`}`
`1057`	`1062`	`}`
`1058`	`1063`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1054,8 +1054,13 @@ TRUST_POLICY=$(cat <<EOF`
`1054`	`1054`	`"Action": "sts:AssumeRoleWithWebIdentity",`
`1055`	`1055`	`"Condition": {`
`1056`	`1056`	`"StringEquals": {`
`1057`		`- "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",`
`1058`		`- "token.actions.githubusercontent.com:sub": "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/deploy"`
	`1057`	`+ "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"`
	`1058`	`+ },`
	`1059`	`+ "StringLike": {`
	`1060`	`+ "token.actions.githubusercontent.com:sub": [`
	`1061`	`+ "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/main",`
	`1062`	`+ "repo:$GITHUB_USERNAME/$GITHUB_REPO_NAME:ref:refs/heads/deploy"`
	`1063`	`+ ]`
`1059`	`1064`	`}`
`1060`	`1065`	`}`
`1061`	`1066`	`}`