Getting issue with id_token permissions

[scottdickerson]

Here's our configuration for using the aws action taken from the documentation. This was working for a long time:

deploy-to-stg:
    name: deploy-to-stg
    environment: stg
    timeout-minutes: 10
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Clone Repository
        uses: actions/checkout@v2
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1

As of about 5 days ago we're getting
The nested job 'deploy-to-stg' is requesting 'id-token: write', but is only allowed 'id-token: none'.

As this says this is a nested workflow job, any ideas for updated configuration steps to fix this?

[scottdickerson]

this turned out to be a change to our organization level permissions for our GITHUB_TOKEN. To fix it I had to explicitly grant the calling parent workflow that id-token permissions.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.