No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

I just created a video on this. I'll share the link when it is out.

So the role you created is it attached to an Identity Provider and if so, is the Audience set correctly and matches your organization name?

If those two are all done correctly, did you select the right policy or permissions set for the type of resources you are trying to manage?

So I haven’t attached any permissions yet… I was just hoping to see whether OIDC itself is set up correctly such that Pulumi can assume the role

I though the error message would look more like “role doesn’t have the permissions to access X resource” if it were a case of the role not having sufficient permissions

but this seems to indicate the process is not even able to assume the role

can you just through in the AdministratorAccess permissions to see if it works?

```["arn:aws:iam::aws:policy/AdministratorAccess"]```


i got the same error, i am trying to retrace where I got that error out of the many errors i got along the way

btw, the thumbprint thing is a bit obscure… hard to understand what to do for that from the docs

<https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html>

<https://www.pulumi.com/docs/guides/oidc/aws/> =&gt; doesn’t make any mention of it

ok same error, even though I added the permission:

For the Trusted entities in the role I have:
```{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::&lt;ACCOUNT-ID&gt;:oidc-provider/api.pulumi.com/oidc"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "<http://api.pulumi.com/oidc:aud|api.pulumi.com/oidc:aud>": "&lt;PULUMI-ORG&gt;",
                    "<http://api.pulumi.com/oidc:sub|api.pulumi.com/oidc:sub>": "pulumi:deploy:org:&lt;PULUMI-ORG&gt;:project:*:*"
                }
            }
        }
    ]
}```

did you replace &lt;PULUMI-ORG&gt; with the name of your org?

yeah (I don’t know why I always worry about copy/pasta with identifying values)

<https://pulumi.zoom.us/j/88499629581?pwd=Nnp0RTFaNHJLN0FXbXVzM0RobHY1UT09>