SAM Doctor

ERROR REFERENCE

No OpenIDConnect provider found in your account

The target AWS account has no IAM OIDC identity provider registered for GitHub Actions, so there is nothing for AssumeRoleWithWebIdentity to trust. Common on first setup and on the first deploy into a new account after the workflow worked elsewhere.

WHAT IT MEANS

What this error means

The OIDC provider is an account-level IAM resource. It existing in your dev account does nothing for prod — every account that workflows deploy into needs its own registration of token.actions.githubusercontent.com. The role's trust policy then references that provider's ARN.

FIX

How to fix it

  1. Check what the account has (read-only): 
    aws iam list-open-id-connect-providers
  2. Register the provider - console (IAM → Identity providers → Add provider) or infrastructure-as-code. Provider URL https://token.actions.githubusercontent.com, audience sts.amazonaws.com.
  3. Point the role's trust policy at the provider ARN in the same account, with the repo-scoped sub condition the standard setup uses.
  4. Prefer registering it in the account's IaC baseline so new accounts get it automatically instead of rediscovering this error.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes the missing-provider wording (high confidence) alongside the rest of the OIDC failure family. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED