diff --git a/.github/workflows/debug-oidc.yml b/.github/workflows/debug-oidc.yml
new file mode 100644
index 0000000000..4f571ce79c
--- /dev/null
+++ b/.github/workflows/debug-oidc.yml
@@ -0,0 +1,20 @@
+name: Test Debugger Action
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  oidc_debug_test:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    name: A test of the oidc debugger
+    steps:
+      - name: Show OIDC claims (right before assume)
+        env:
+          AUDIENCE: "sts.amazonaws.com"
+        run: |
+          TOKEN_JSON=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=$AUDIENCE")
+          ID_TOKEN=$(echo "$TOKEN_JSON" | jq -r .value)
+          echo "$ID_TOKEN" | awk -F. '{print $2}' | base64 -d 2>/dev/null | jq -r