In this case, your runner's credentials must have permissions to assume the role. You can also assume a role using a web identity token file, such as if using Amazon EKS IRSA. Pods running in EKS ...

An IAM user with permission to assume the target IAM role using static access ID key/secret access key credentials (the old way). Via a GitHub OpenID Connect identity provider (OIDC), which avoids the ...