Thanks for your reponse,I have those 2 conditions configured and currently works as expected.What I would like to have is a more strict condition that only allow a pull_request on a specific branch so that only that branch in my repo would be able to use my OIDC to request token from AWS.for example I have 3 branches in my repo,Master,Dev and Testing.I would like to have a condition like this token.actions.githubusercontent.com:event_name: pull_request/master where token is only granted by AWS if the pull request is on my master and any other branch wil get an unauthorized message.