I have a pretty standard trust relationship for a role defined (and is working) as such:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::123456:oidc-provider/oidc.eks.namehere.amazonaws.com/id/TGIFridays"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.namehere.amazonaws.com/id/TGIFridays:sub": "system:serviceaccount:namespace:name",
                    "oidc.eks.namehere.amazonaws.com/id/TGIFridays:aud": "sts.amazonaws.com"
                }
            }
        }
    ]
}

Now, I found another service account in the same cluster using the same role, that I want to specify the condition to use as well.

so my hope was to add another line to the trust policy like so:

"Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "oidc.eks.namehere.amazonaws.com/id/TGIFridays:sub": "system:serviceaccount:namespace:name",
                    "oidc.eks.namehere.amazonaws.com/id/TGIFridays:aud": "sts.amazonaws.com",
                    "oidc.eks.namehere.amazonaws.com/id/TGIFridays:sub": "system:serviceaccount:namespace:nameofnewaccount"
                }

However, AWS complains when doing that. I have tried alternative syntactical approaches, but I am having a difficult time finding an answer when googling for this use case. The web pages that show up usually talk about defining multiple principles.

So, the question is: What is the correct syntax for defining two different service accounts in the condition for a trust policy?