I have a GHA workflow authenticating to AWS using OIDC.

The role is indeed assumed (the authentication part is successful).

Here is the role’s permissions policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecr:CompleteLayerUpload",
                "ecr:UploadLayerPart",
                "ecr:InitiateLayerUpload",
                "ecr:BatchCheckLayerAvailability",
                "ecr:PutImage"
            ],
            "Resource": "arn:aws:ecr:eu-west1:12345678910:repository/my-repo"
        },
        {
            "Effect": "Allow",
            "Action": "ecr:GetAuthorizationToken",
            "Resource": "*"
        }
    ]
}

The push however fails with:

failed to push 12345678910.dkr.ecr.eu-west-1.amazonaws.com/my-repo:latest: unexpected status from HEAD request to https://12345678910.dkr.ecr.eu-west-1.amazonaws.com/v2/my-repo/manifests/sha256:14b2b8ef8c30920efgb3f9dr2b1043743e957eg5cb2fh7ah4j40620ef62d8ab2: 403 Forbidden

Why is that?

I have leveraged the sample policy from this part of AWS’ docs.