sts:AssumeRoleWithWebIdentity Not Authorized Error

[orilani]

Describe the bug

I'm encountering an issue when trying to use the configure-aws-credentials action to assume a role with OIDC authentication. The step fails with the following error:

Assuming role with OIDC
Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

im using self hosted runner on EKS using IRSA on account A trying to assume role in account B.

Troubleshooting Steps Taken:

Verified that the IAM role exists and trust policy is correct.
Confirmed the GitHub OIDC provider is correctly set up in AWS IAM.
Confirmed that the sub and aud conditions match the expected GitHub Actions workflow.
Tried with different role-session-name values to isolate the issue.

successfully assume role from inside the runner console with aws cli, action failed.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

being able to assume role from aws account A to role in account B.

Current Behavior

Getting timeout for trying to assume role with oidc.

Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Assuming role with OIDC
Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

Reproduction Steps

name: Verify Terraform Plan

on:
workflow_dispatch:
pull_request:
branches:
- main

jobs:
terraform-plan:
name: Terraform Plan
runs-on: runner-prod-tf

permissions:
  id-token: write
  contents: read

strategy:
  matrix:
    dir:
      - env: dev
        aws_account: 123123123

steps:
  - name: Checkout Repository
    uses: actions/checkout@v4

  - name: Configure AWS Credentials (Only for Dev)
    if: matrix.dir.env == 'dev'  # This step runs only in dev
    uses: aws-actions/configure-aws-credentials@v3
    with:
      role-to-assume: arn:aws:iam::${{ matrix.dir.aws_account }}:role/arc-runners-tf-${{ matrix.dir.env }}
      aws-region: eu-central-1
      role-session-name: runner-prod-tf

  - name: Verify AWS Authentication
    run: aws sts get-caller-identity

  - name: Verify Terraform in Devbox
    run: |
      devbox run which terraform
      devbox run terraform --version

  - name: Initialize Terraform
    working-directory: envs/${{ matrix.dir.env }}
    run: devbox run -- bash -c "cd $(pwd) && terraform init"

  - name: Run Terraform Plan
    working-directory: envs/${{ matrix.dir.env }}
    run: devbox run -- bash -c "cd $(pwd) && terraform plan"

Possible Solution

No response

Additional Information/Context

tried using oidc, output-credentials nothing helped