Technical Concepts
OIDC subject and audience
The OIDC subject pins which repository and branch may assume your role, and the audience pins who the token was minted for.
What they are
When GitHub mints an OIDC token for a workflow run, the token carries claims. Two of them are what your role's trust policy checks.
Subject (sub) — identifies the workflow's origin:
repo:<owner>/<repo>:ref:refs/heads/mainAudience (aud) — identifies who the token was minted for:
sts.amazonaws.comWhat pinning them achieves
| Claim | Pinned to | What it prevents |
|---|---|---|
| Subject | One repository, one branch | A workflow in any other repository — including a fork — assuming your role |
| Audience | AWS STS | A token minted for some other service being replayed against your account |
Without a subject condition, any GitHub Actions workflow anywhere could assume a role that trusts the GitHub OIDC provider. The subject condition is what turns "trusts GitHub" into "trusts exactly one workflow".
Where to read yours
The values are written into your own trust policy when the CloudFormation stack is created. Open the role in your IAM console, read the trust relationship, and the token.actions.githubusercontent.com:sub and :aud conditions are both there.