From d1edd20a7eef87a395b74fda0f1d46adc6797e19 Mon Sep 17 00:00:00 2001
From: Alex Blewitt <alex.blewitt@gmail.com>
Date: Fri, 8 Jul 2022 23:26:57 +0100
Subject: [PATCH] Updated README.md for information about using alternate
 audiences

---
 README.md | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 9a2cf6a..c8ffad1 100644
--- a/README.md
+++ b/README.md
@@ -82,6 +82,7 @@ The default session duration is 1 hour when using the OIDC provider to directly
 The default session duration is 6 hours when using an IAM User to assume an IAM Role (by providing an `aws-access-key-id`, `aws-secret-access-key`, and a `role-to-assume`) .
 If you would like to adjust this you can pass a duration to `role-duration-seconds`, but the duration cannot exceed the maximum that was defined when the IAM Role was created.
 The default session name is GitHubActions, and you can modify it by specifying the desired name in `role-session-name`.
+The default audience is `sts.amazonaws.com` which you can replace by specifying the desired audience name in `audience`.
 
 The following table describes which identity is used based on which values are supplied to the Action:
 
@@ -98,7 +99,6 @@ The following table describes which identity is used based on which values are s
     - name: Configure AWS Credentials
       uses: aws-actions/configure-aws-credentials@v1
       with:
-        audience: sts.amazonaws.com
         aws-region: us-east-2
         role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
         role-session-name: MySessionName
@@ -109,7 +109,6 @@ In this example, the Action will load the OIDC token from the GitHub-provided en
     - name: Configure AWS Credentials
       uses: aws-actions/configure-aws-credentials@v1
       with:
-        audience: sts.amazonaws.com
         aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
         aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         aws-region: us-east-2
@@ -120,6 +119,19 @@ In this example, the Action will load the OIDC token from the GitHub-provided en
 ```
 In this example, the secret `AWS_ROLE_TO_ASSUME` contains a string like `arn:aws:iam::123456789100:role/my-github-actions-role`.  To assume a role in the same account as the static credentials, you can simply specify the role name, like `role-to-assume: my-github-actions-role`.
 
+```yaml
+    - name: Configure AWS Credentials for Beta Customers
+      uses: aws-actions/configure-aws-credentials@v1
+      with:
+        audience: beta-customers
+        aws-region: us-east-3
+        role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
+        role-session-name: MySessionName
+```
+In this example, the audience has been changed from the default to use a different audience name `beta-customers`. This can help ensure that the role can only affect those AWS accounts whose GitHub OIDC providers have explicitly opted in to the `beta-customers` label.
+
+Changing the default audience may be necessary when using non-default [AWS partitions](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+
 ### Sample IAM Role CloudFormation Template
 ```yaml
 Parameters: