# iss=https://token.actions.githubusercontent.com · aud=aws|azure|gcp
Workload identity trust, checked against the token
Paste a trust policy, describe the GitHub Actions job, and see whether AWS, Microsoft Entra or Google Cloud would accept its token, which condition decides it, and what to tighten. It runs in your browser; nothing is sent anywhere.
Same repository, two subjects
GitHub now puts numeric owner and repository IDs into the sub claim for repositories created, renamed or transferred after July 15, 2026. A trust rule written for the old string stops matching, and the deploy fails with an authorization error.
Rules that match names also have a quieter problem: if the name is ever released, whoever registers it next gets tokens with the same subject. The checker flags both.
policy expects
repo:octo-org/octo-repo:ref:refs/heads/main
token sends
repo:octo-org@123456/octo-repo@456789:ref:refs/heads/main
✗ StringEquals sub — no match → AccessDenied
Guides
all guides →- job/github-oidc-immutable-subject category CI/CD federation
GitHub's immutable OIDC subject claims, fixed in AWS, Azure and Google Cloud
Repositories created after July 15, 2026 send a new sub format with owner and repository IDs. What changed, how to tell which format you get, and the trust changes for each cloud.
· 8 min - job/fix-not-authorized-assumerolewithwebidentity category Troubleshooting
Fixing “Not authorized to perform sts:AssumeRoleWithWebIdentity” in GitHub Actions
A checklist for the AWS OIDC error, ordered by how often each cause applies: sub format, job context, wildcards under StringEquals, audience, provider ARN and customized claims.
· 7 min - job/github-actions-aws-oidc category CI/CD federation
Scoping a GitHub Actions trust policy in AWS
Which condition keys to use in an IAM role trust policy for GitHub Actions, which ones are immutable, and worked examples for a branch, an environment and a reusable workflow.
· 8 min - job/github-oidc-trust-aws category CI/CD federation
One workflow, three clouds: how AWS, Azure and Google Cloud match GitHub OIDC tokens
The same GitHub Actions token is checked three different ways. A side-by-side comparison of where the trust lives, how claims are matched, wildcard support, limits and how failures show up.
· 7 min - job/oidc-subject-recycling category Risks
Subject recycling: when a deleted GitHub name still unlocks your cloud role
Trust rules that match names can be satisfied by whoever registers that name next. What the 2026 research found, what GitHub, GitLab and the clouds changed, and how to audit your own roles.
· 7 min
How this site is made
Every rule in the checker and every factual sentence in the guides is tied to the issuer's or cloud provider's own documentation, linked at the bottom of each page with the date we checked it. Nobody here has tested products for you, and nothing is sponsored. Read the editorial policy.