SAM Doctor

ERROR REFERENCE

Incorrect token audience (InvalidIdentityToken)

AWS STS rejected the GitHub OIDC token because its audience claim does not match what the IAM identity provider expects. The token is real and fresh — it was just minted for a different consumer.

WHAT IT MEANS

What this error means

The audience (aud) claim says who a token is for. The standard AWS setup expects sts.amazonaws.com, which is what aws-actions/configure-aws-credentials requests by default. The mismatch appears when a workflow requests a custom audience, or the IAM OIDC provider was registered with a different client ID than the tokens carry.

FIX

How to fix it

  1. Check what the provider expects (read-only): 
    aws iam get-open-id-connect-provider \
  --open-id-connect-provider-arn <provider-arn>
    The ClientIDList should contain sts.amazonaws.com for the standard setup.
  2. Check what the workflow requests. A custom audience: input on the credentials step must match an entry in that client ID list exactly; if you have no reason for a custom audience, remove the input and use the default.
  3. Align the two — either add the custom audience to the provider's client IDs, or stop requesting it. One source of truth, not two.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes the audience rejection (high confidence) and separates it from trust-policy subject mismatches, which say "Not authorized" instead. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED