Facing credential issue while promting release on production through github actions

[DevOps-Hestabit-1]

I'm encountering a strange issue during the deployment in production. We use the same AWS IAM role for both staging and production deployments. While it works perfectly fine for staging, But I'm getting the following error when attempting to deploy in production:

Error: Could not load credentials from ChainableTemporaryCredentials2: Missing credentials in config, if using AWS_CONFIG_FILE, set AWS_SDK_LOAD_CONFIG=1: Could not load credentials from ChainableTemporaryCredentials2: The security token included in 
the request is expired.

[peterwoodworth]

Could you elaborate on how credentials are being set in your actions runner?

[DevOps-Hestabit-1]

We are using like this role-to-assume: arn:aws:iam::000000000:role/IAMROLE

[peterwoodworth]

I'm not sure how that comes into play, are you using configure-aws-credentials? If so, after you run the configure aws credentials step, try running a step that runs aws sts get-caller-identity. Does your runner return the credentials you expect in this step?

[DevOps-Hestabit-1]

First of all thank you helping me out . Yes it returns I am attaching both snippet

This one is build-image.yml which works fine

name: Build Image and push to ECR
on:
  workflow_dispatch:
  push:
    branches: [master]

permissions:
  id-token: write
  contents: read
jobs:
  build:
    name: Build Image
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v2
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: eu-central-1
          role-to-assume: arn:aws:iam::0000000:role/test
          role-session-name: test
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
      - name: Build, tag, and push image to Amazon ECR
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: test-repo
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
      - name: Deploying latest image to staging
        uses: youyo/aws-cdk-github-actions@v2
        with:
          working_dir: '_infra/cdk'
          cdk_subcommand: 'deploy'
          cdk_stack: 'TestStagingStack'
          cdk_args: "--require-approval never -c imageTag=${{ github.sha }}"
          actions_comment: false
`

This one is promote-release.yml facing issue with this

name: Promote release to production
on:
  release:
    types:
      - created

permissions:
  id-token: write
  contents: read
jobs:
  build:
    name: Promote release
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v2
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: eu-central-1
          role-to-assume: arn:aws:iam::0000000000:role/test
          role-session-name: test

      - name: Get the version
        id: get_version
        run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
      - name: Re-tag the latest image in ECR
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          VERSION: ${{ steps.get_version.outputs.VERSION }}
          ECR_REPOSITORY: test-repo
        run: |
          MANIFEST=$(aws ecr batch-get-image --repository-name $ECR_REPOSITORY --image-ids imageTag=latest --output json | jq --raw-output --join-output '.images[0].imageManifest')
          aws ecr put-image --repository-name $ECR_REPOSITORY --image-tag $VERSION  --image-manifest "$MANIFEST"
      - name: Deploying new version to production
        uses: youyo/aws-cdk-github-actions@v2
        with:
          working_dir: '_infra/cdk'
          cdk_subcommand: 'deploy'
          cdk_stack: 'TestProductionStack'
          cdk_args: "--require-approval never -c imageTag=${{ steps.get_version.outputs.VERSION }}"
          actions_comment: false

`