From iam-oidc-triage
Use when GitHub Actions or another OIDC caller gets AWS sts:AssumeRole or sts:AssumeRoleWithWebIdentity AccessDenied — not when auth succeeds and the remaining failure is in SAM, CloudFormation, or Terraform execution.
How this skill is triggered — by the user, by Claude, or both
Slash command
/iam-oidc-triage:iam-oidc-triageThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill when an OIDC-federated caller cannot assume an AWS role and the priority is to prove or fix the IAM trust, provider, audience, subject, or tagging contract before investigating later workflow stages.
Use this skill when an OIDC-federated caller cannot assume an AWS role and the priority is to prove or fix the IAM trust, provider, audience, subject, or tagging contract before investigating later workflow stages.
AccessDenied on sts:AssumeRole or sts:AssumeRoleWithWebIdentity.| Situation | Use this skill? | Route instead |
|---|---|---|
| OIDC trust-policy, audience, subject, provider, or session-tag issue causing AssumeRole denial | Yes | - |
| Auth succeeds, but the SAM or CloudFormation stack then fails | No | sam-cloudformation |
| Terraform-managed infrastructure fails during plan/apply after auth | No | terraform-skill |
| The failure is earlier in the workflow or not IAM-related | No | github-actions-failure-triage |
| Lambda packaging or runtime is broken after deployment auth | No | aws-lambda-go-deployment |
Required before editing
AccessDenied log line, including whether the failing action is sts:AssumeRole or sts:AssumeRoleWithWebIdentity.sub, and audience.Helpful if present
Only investigate if encountered
sub/aud claims.AccessDenied on sts:AssumeRole or sts:AssumeRoleWithWebIdentity as the primary blocker; do not investigate plan drift or stack rollback first.token.actions.githubusercontent.com:aud should be sts.amazonaws.comtoken.actions.githubusercontent.com:sub must match the repository and ref pattern that actually triggered the runsts:AssumeRoleWithWebIdentity for OIDC federation.runtime = "CircleCI"aws:RequestedRegion; if so, verify the caller includes them.sam-cloudformation, terraform-skill, or github-actions-failure-triage once IAM is no longer the blocker.sts:AssumeRole vs sts:AssumeRoleWithWebIdentity) matches the trust-policy path you are fixing.token.actions.githubusercontent.com:aud is sts.amazonaws.com and that sub matches the real repo/ref or PR pattern.sam deploy then rolls back on an invalid template property." (→ sam-cloudformation)sub, aud, and session-tag requirements match the repo, branch, and event that triggered the workflow."references/trust-policy-checklist.md - quick checks for trust-policy conditions, CircleCI migration leftovers, session tags, and route-away cues.Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.
npx claudepluginhub matt-riley/lucky-hat --plugin iam-oidc-triage