So the role you created is it attached to an Identity Provider and if so, is the Audience set correctly and matches your organization name?

If those two are all done correctly, did you select the right policy or permissions set for the type of resources you are trying to manage?

I though the error message would look more like “role doesn’t have the permissions to access X resource” if it were a case of the role not having sufficient permissions

but this seems to indicate the process is not even able to assume the role

yeah try that and tell me if it works

btw, the thumbprint thing is a bit obscure… hard to understand what to do for that from the docs

https://www.pulumi.com/docs/guides/oidc/aws/ => doesn’t make any mention of it

ok same error, even though I added the permission:

For the Trusted entities in the role I have:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<ACCOUNT-ID>:oidc-provider/api.pulumi.com/oidc"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "<http://api.pulumi.com/oidc:aud|api.pulumi.com/oidc:aud>": "<PULUMI-ORG>",
          "<http://api.pulumi.com/oidc:sub|api.pulumi.com/oidc:sub>": "pulumi:deploy:org:<PULUMI-ORG>:project:*:*"
        }
      }
    }
  ]
}

And I have this for the id provider:

if you want to jump on