GitHub Actions通过AWS OIDC登录失败，求排查原因

有人能帮我排查为何GitHub Actions无法通过OIDC登录AWS吗？

我已在AWS控制台创建了OIDC提供商，并且为角色配置了如下信任关系：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::852523567171:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:sub": "repo:headincloud/hic-public-dns:*",
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

按此配置应该允许所有分支通过OIDC访问AWS，对吗？

我的GitHub Action配置如下：

name: preview-changes
on:
  push:
    branches:
      - main
jobs:
  up:
    name: Preview
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::852523567171:role/github-actions-dns
          aws-region: eu-west-1

需说明：所列ARN均正确。

但我的GitHub Action仍报错：

Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

我的配置中究竟遗漏了什么？

内容的提问来源于stack exchange，提问作者Jeroen Jacobs