为何无法创建Workload Identity Pool Provider？报错需引用声明

我搞不懂为什么我的Workload Identity Federation资源声明创建失败，收到的错误提示显示必须引用提供者的其中一个声明：

╷
│ Error: Error creating WorkloadIdentityPoolProvider: googleapi: Error 400: The attribute condition must reference one of the provider's claims. For more information, see https://cloud.google.com/iam/docs/workload-identity-federation-with-deployment-pipelines#conditions
│
│ with google_iam_workload_identity_pool_provider.github_provider,
│ on github-actions-sa.tf line 14, in resource "google_iam_workload_identity_pool_provider" "github_provider":
│ 14: resource "google_iam_workload_identity_pool_provider" "github_provider" ***
│
╵

根据GitHub相关文档，repository和repository_owner声明应该存在，且相关社区讨论指出repository_owner是必填项。我已经在attribute_mapping中引用了这些声明，配置代码如下：

resource "google_iam_workload_identity_pool_provider" "github_provider" {
  project                            = var.project_id
  display_name                       = "GitHub Provider"
  workload_identity_pool_id          = google_iam_workload_identity_pool.github_actions_pool.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-provider"
  provider                           = google
  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }

  attribute_mapping = {
    "google.subject"             = "assertion.sub"
    "attribute.repository"       = "assertion.repository"
    "attribute.repository_owner" = "assertion.repository_owner"
  }
}

resource "google_service_account_iam_binding" "allow_github" {
  service_account_id = google_service_account.service_account.id
  role               = "roles/iam.workloadIdentityUser"

  members = [
    "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github_actions_pool.name}/attribute.repository/${var.github_organisation}/my-project",
    "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github_actions_pool.name}/attribute.repository_owner/${var.github_organisation}"
  ]
}

内容的提问来源于stack exchange，提问作者Stefan Falk