sts:AssumeRoleWithWebIdentity

Write

sts:AssumeRoleWithWebIdentity is a Write access-level action in the sts service. Grants permission to obtain a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider

Resource types

ARNs that sts:AssumeRoleWithWebIdentity can be scoped to in an IAM policy.

arn:${Partition}:iam::${Account}:role/${RoleNameWithPath} required
role

Condition keys

Keys you can use in the Condition block of a policy that grants sts:AssumeRoleWithWebIdentity.

accounts.google.com:aud String

Filters access by the Google application ID

accounts.google.com:google/organization_number Numeric

Filters access by the Google Cloud or Google Workspace organization number

accounts.google.com:oaud String

Filters access by the Google audience

accounts.google.com:sub String

Filters access by the subject of the claim (the Google user ID)

agent.${Domain}.buildkite.dev:build_branch String

Filters access by the git branch that triggered the Buildkite build

agent.${Domain}.buildkite.dev:cluster_id String

Filters access by the Buildkite cluster ID

agent.${Domain}.buildkite.dev:cluster_name String

Filters access by the Buildkite cluster name

agent.${Domain}.buildkite.dev:organization_id String

Filters access by the Buildkite organization ID

agent.${Domain}.buildkite.dev:organization_slug String

Filters access by the Buildkite organization slug

agent.${Domain}.buildkite.dev:pipeline_id String

Filters access by the Buildkite pipeline ID

agent.${Domain}.buildkite.dev:pipeline_slug String

Filters access by the Buildkite pipeline slug

agent.${Domain}.buildkite.site:build_branch String

Filters access by the git branch that triggered the Buildkite build

agent.${Domain}.buildkite.site:cluster_id String

Filters access by the Buildkite cluster ID

agent.${Domain}.buildkite.site:cluster_name String

Filters access by the Buildkite cluster name

agent.${Domain}.buildkite.site:organization_id String

Filters access by the Buildkite organization ID

agent.${Domain}.buildkite.site:organization_slug String

Filters access by the Buildkite organization slug

agent.${Domain}.buildkite.site:pipeline_id String

Filters access by the Buildkite pipeline ID

agent.${Domain}.buildkite.site:pipeline_slug String

Filters access by the Buildkite pipeline slug

agent.buildkite.com:build_branch String

Filters access by the git branch that triggered the Buildkite build

agent.buildkite.com:cluster_id String

Filters access by the Buildkite cluster ID

agent.buildkite.com:cluster_name String

Filters access by the Buildkite cluster name

agent.buildkite.com:organization_id String

Filters access by the Buildkite organization ID

agent.buildkite.com:organization_slug String

Filters access by the Buildkite organization slug

agent.buildkite.com:pipeline_id String

Filters access by the Buildkite pipeline ID

agent.buildkite.com:pipeline_slug String

Filters access by the Buildkite pipeline slug

aws:RequestTag/${TagKey} String

Filters access by the tags that are passed in the request

aws:TagKeys ArrayOfString

Filters access by the tag keys that are passed in the request

cognito-identity.amazonaws.com:amr String

Filters access by the login information for Amazon Cognito

cognito-identity.amazonaws.com:aud String

Filters access by the Amazon Cognito identity pool ID

cognito-identity.amazonaws.com:sub String

Filters access by the subject of the claim (the Amazon Cognito user ID)

github.com/enterprises/${EnterpriseName}:actor String

Filters access by the personal account that initiated the workflow run

github.com/enterprises/${EnterpriseName}:actor_id String

Filters access by the ID of the personal account that initiated the workflow run

github.com/enterprises/${EnterpriseName}:enterprise_id String

Filters access by the ID of the enterprise that contains the repository from where the workflow is running

github.com/enterprises/${EnterpriseName}:environment String

Filters access by the name of the environment used by the job

github.com/enterprises/${EnterpriseName}:job_workflow_ref String

Filters access by the reference path to the reusable workflow for jobs using a reusable workflow

github.com/enterprises/${EnterpriseName}:ref String

Filters access by the git ref (branch or tag) that triggered the workflow run

github.com/enterprises/${EnterpriseName}:repository String

Filters access by the repository from where the workflow is running

github.com/enterprises/${EnterpriseName}:repository_id String

Filters access by the ID of the repository from where the workflow is running

github.com/enterprises/${EnterpriseName}:repository_owner_id String

Filters access by the ID of the repository owner from where the workflow is running

github.com/enterprises/${EnterpriseName}:workflow String

Filters access by the name of the workflow

gitlab.com:namespace_id String

Filters access by the GitLab namespace (group) ID of the project running the CI/CD job

gitlab.com:pipeline_source String

Filters access by the source that triggered the GitLab pipeline

gitlab.com:project_id String

Filters access by the GitLab project ID running the CI/CD job

gitlab.com:ref_protected String

Filters access by whether the GitLab git ref that triggered the job is protected

gitlab.com:runner_environment String

Filters access by the GitLab runner environment for the CI/CD job

gitlab.com:user_access_level String

Filters access by the GitLab user access level within the project

gitlab.com:user_email String

Filters access by the GitLab user email executing the CI/CD job

gitlab.com:user_id String

Filters access by the GitLab user ID executing the CI/CD job

gitlab.com:user_login String

Filters access by the GitLab username executing the CI/CD job

graph.facebook.com:app_id String

Filters access by the Facebook application ID

graph.facebook.com:id String

Filters access by the Facebook user ID

idcs-${OciUniqueIdentifier}.identity.oraclecloud.com:rpst_id String

Filters access by the OCI resource principal session token ID

oidc.circleci.com/org/${OrgId}:oidc.circleci.com/project-id String

Filters access by the CircleCI project ID

sts:RoleAuthorizedByIdp Bool

Filters access based on whether the identity provider authorized the role via the roles claim in the OIDC token

sts:RoleSessionName String

Filters access by the role session name required when you assume a role

sts:SourceIdentity String

Filters access by the source identity that is passed in the request

sts:TransitiveTagKeys ArrayOfString

Filters access by the transitive tag keys that are passed in the request

token.actions.${Domain}.ghe.com:actor String

Filters access by the personal account that initiated the workflow run

token.actions.${Domain}.ghe.com:actor_id String

Filters access by the ID of the personal account that initiated the workflow run

token.actions.${Domain}.ghe.com:enterprise_id String

Filters access by the ID of the enterprise that contains the repository from where the workflow is running

token.actions.${Domain}.ghe.com:environment String

Filters access by the name of the environment used by the job

token.actions.${Domain}.ghe.com:job_workflow_ref String

Filters access by the reference path to the reusable workflow for jobs using a reusable workflow

token.actions.${Domain}.ghe.com:ref String

Filters access by the git ref (branch or tag) that triggered the workflow run

token.actions.${Domain}.ghe.com:repository String

Filters access by the repository from where the workflow is running

token.actions.${Domain}.ghe.com:repository_id String

Filters access by the ID of the repository from where the workflow is running

token.actions.${Domain}.ghe.com:repository_owner_id String

Filters access by the ID of the repository owner from where the workflow is running

token.actions.${Domain}.ghe.com:workflow String

Filters access by the name of the workflow

token.actions.githubusercontent.com/${SubPath}:actor String

Filters access by the personal account that initiated the workflow run

token.actions.githubusercontent.com/${SubPath}:actor_id String

Filters access by the ID of the personal account that initiated the workflow run

token.actions.githubusercontent.com/${SubPath}:enterprise_id String

Filters access by the ID of the enterprise that contains the repository from where the workflow is running

token.actions.githubusercontent.com/${SubPath}:environment String

Filters access by the name of the environment used by the job

token.actions.githubusercontent.com/${SubPath}:job_workflow_ref String

Filters access by the reference path to the reusable workflow for jobs using a reusable workflow

token.actions.githubusercontent.com/${SubPath}:ref String

Filters access by the git ref (branch or tag) that triggered the workflow run

token.actions.githubusercontent.com/${SubPath}:repository String

Filters access by the repository from where the workflow is running

token.actions.githubusercontent.com/${SubPath}:repository_id String

Filters access by the ID of the repository from where the workflow is running

token.actions.githubusercontent.com/${SubPath}:repository_owner_id String

Filters access by the ID of the repository owner from where the workflow is running

token.actions.githubusercontent.com/${SubPath}:workflow String

Filters access by the name of the workflow

token.actions.githubusercontent.com:actor String

Filters access by the personal account that initiated the workflow run

token.actions.githubusercontent.com:actor_id String

Filters access by the ID of the personal account that initiated the workflow run

token.actions.githubusercontent.com:enterprise_id String

Filters access by the ID of the enterprise that contains the repository from where the workflow is running

token.actions.githubusercontent.com:environment String

Filters access by the name of the environment used by the job

token.actions.githubusercontent.com:job_workflow_ref String

Filters access by the reference path to the reusable workflow for jobs using a reusable workflow

token.actions.githubusercontent.com:ref String

Filters access by the git ref (branch or tag) that triggered the workflow run

token.actions.githubusercontent.com:repository String

Filters access by the repository from where the workflow is running

token.actions.githubusercontent.com:repository_id String

Filters access by the ID of the repository from where the workflow is running

token.actions.githubusercontent.com:repository_owner_id String

Filters access by the ID of the repository owner from where the workflow is running

token.actions.githubusercontent.com:workflow String

Filters access by the name of the workflow

www.amazon.com:app_id String

Filters access by the Login with Amazon application ID

www.amazon.com:user_id String

Filters access by the Login with Amazon user ID

aws:ResourceTag/${TagKey} String

Filters access by the tags associated with the resource

iam:ResourceTag/${TagKey} String

Filters access by the tags that are attached to the role that is being assumed

Example IAM policy

A minimal policy that allows sts:AssumeRoleWithWebIdentity. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowStsAssumeRoleWithWebIdentity",
      "Effect": "Allow",
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Resource": "*"
    }
  ]
}

Related actions in sts

sts:AssumeRole Write sts:AssumeRoleWithSAML Write sts:AssumeRoot Write sts:DecodeAuthorizationMessage Write sts:GetAccessKeyInfo Read sts:GetCallerIdentity Read sts:GetDelegatedAccessToken Write sts:GetFederationToken Write sts:GetServiceBearerToken Read sts:GetSessionToken Read sts:GetWebIdentityToken Write sts:SetContext Write

View all sts actions →