Cross account assume role using IAM Credentials

[lkashef]

I tried following this example but it keeps retrying and eventually fail with the message:

Could not assume role with user credentials: User: arn:aws:iam::***:user/*** is not authorized to perform: sts:TagSession on resource: ***

The user supposedly has the right permissions as it worked properly from my terminal using the same IAM Credentials and also worked okay with a workflow that uses aws-cli, I will post both files for reference:

name: 'Deploy to AWS CloudFormation' on: pull_request: branches: [main] workflow_dispatch: jobs: deploy: runs-on: ubuntu-22.04 steps: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v4 with: aws-access-key-id: ${{ secrets.CI_AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.CI_AWS_SECRET_ACCESS_KEY }} aws-region: us-east-1 role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN_STAGING }} role-duration-seconds: 1200 role-session-name: GitHubActions 

name: 'Deploy to AWS CloudFormation' on: pull_request: branches: [main] workflow_dispatch: jobs: deploy: runs-on: ubuntu-22.04 steps: - name: Install & Configure AWS CLI run: | sudo apt-get install awscli aws configure set aws_access_key_id ${{ secrets.CI_AWS_ACCESS_KEY_ID }} aws configure set aws_secret_access_key ${{ secrets.CI_AWS_SECRET_ACCESS_KEY }} aws configure set default.region us-east-1 - name: Assume Role run: | TEMP_ROLE=$(aws sts assume-role --role-arn ${{ secrets. CI_AWS_ROLE_ARN_STAGING }} --role-session-name GitHubActions) export AWS_ACCESS_KEY_ID=$(echo $TEMP_ROLE | jq -r .Credentials.AccessKeyId) export AWS_SECRET_ACCESS_KEY=$(echo $TEMP_ROLE | jq -r .Credentials.SecretAccessKey) export AWS_SESSION_TOKEN=$(echo $TEMP_ROLE | jq -r .Credentials.SessionToken) 

[lkashef]

Turned out it was a permission issue. it worked using AWS CLI because my command didn't configure session tagging and the user didn't have the sts:TagSession but it did have sts:AssumeRole. adding both fixed the issue

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[ghost]

We could have alternatively used role-skip-session-tagging: true provided by the action to skip session tagging. This would have eliminated the need to update the IAM user.