AWS IAM documentation change
Summary
Added hyperlinks to external documentation for OIDC providers and added note about IBM Turbonomic OIDC issuer URL updates
Security assessment
The change adds references to external security documentation for configuring OIDC integrations, which improves security guidance. However, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/IAM/latest/UserGuide/id_roles_providers_oidc_secure-by-default.md b/IAM/latest/UserGuide/id_roles_providers_oidc_secure-by-default.md index b17538ae8..04cef5949 100644 --- a//IAM/latest/UserGuide/id_roles_providers_oidc_secure-by-default.md +++ b//IAM/latest/UserGuide/id_roles_providers_oidc_secure-by-default.md @@ -33,8 +33,8 @@ OIDC IdP | OIDC URL | Tenancy Claim | Required Claims -Buildkite | `https://agent.buildkite.com` | sub | `agent.buildkite.com:sub` -Codefresh SaaS | `https://oidc.codefresh.io` | sub | `oidc.codefresh.io:sub` -DVC Studio | `https://studio.datachain.ai/api` | sub | `studio.datachain.ai/api:sub` -GitHub actions | `https://token.actions.githubusercontent.com` | sub | `token.actions.githubusercontent.com:sub` -GitHub audit log streaming | `https://oidc-configuration.audit-log.githubusercontent.com` | sub | `oidc-configuration.audit-log.githubusercontent.com:sub` -GitHub vstoken | `https://vstoken.actions.githubusercontent.com` | sub | `vstoken.actions.githubusercontent.com:sub` -GitLab | `https://gitlab.com` | sub | `gitlab.com:sub` -IBM Turbomatic SaaS | +[Buildkite](https://buildkite.com/docs/pipelines/security/oidc/aws) | `https://agent.buildkite.com` | sub | `agent.buildkite.com:sub` +[Codefresh SaaS](https://codefresh.io/docs/docs/integrations/oidc-pipelines/) | `https://oidc.codefresh.io` | sub | `oidc.codefresh.io:sub` +[DVC Studio](https://dvc.org/doc/studio/user-guide/openid-connect) | `https://studio.datachain.ai/api` | sub | `studio.datachain.ai/api:sub` +[GitHub actions](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) | `https://token.actions.githubusercontent.com` | sub | `token.actions.githubusercontent.com:sub` +[GitHub audit log streaming](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise) | `https://oidc-configuration.audit-log.githubusercontent.com` | sub | `oidc-configuration.audit-log.githubusercontent.com:sub` +[GitHub vstoken](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) | `https://vstoken.actions.githubusercontent.com` | sub | `vstoken.actions.githubusercontent.com:sub` +[GitLab](https://docs.gitlab.com/ci/cloud_services/aws/) | `https://gitlab.com` | sub | `gitlab.com:sub` +[IBM Turbonomic SaaS*](https://www.ibm.com/docs/en/tarm/8.16.x?topic=turbonomic-setting-up-aws-iam-role-saas-deployments) | @@ -59,5 +59,7 @@ IBM Turbomatic SaaS | -sandboxes.cloud | `https://sandboxes.cloud` | aud | `sandboxes.cloud:aud` -Scalr | `https://scalr.io` | sub | `scalr.io:sub` -Shisho Cloud | `https://tokens.cloud.shisho.dev` | sub | `tokens.cloud.shisho.dev:sub` -Terraform Cloud | `https://app.terraform.io` | sub | `app.terraform.io:sub` -Upbound | `https://proidc.upbound.io` | sub | `proidc.upbound.io:sub` +[sandboxes.cloud](https://docs.sandboxes.cloud/docs/cloud-resources-setup) | `https://sandboxes.cloud` | aud | `sandboxes.cloud:aud` +[Scalr](https://docs.scalr.io/docs/aws) | `https://scalr.io` | sub | `scalr.io:sub` +[Shisho Cloud](https://shisho.dev/docs/g/getting-started/integrate-apps/aws/) | `https://tokens.cloud.shisho.dev` | sub | `tokens.cloud.shisho.dev:sub` +[Terraform Cloud](https://developer.hashicorp.com/terraform/cloud-docs/workspaces/dynamic-provider-credentials/aws-configuration) | `https://app.terraform.io` | sub | `app.terraform.io:sub` +[Upbound](https://docs.upbound.io/providers/provider-aws/authentication/) | `https://proidc.upbound.io` | sub | `proidc.upbound.io:sub` + +* IBM Turbonomic periodically updates their OIDC Issuer URL with new versions of the platform. We will add additional Turbonomic OIDC issuers in scope as a shared provider as needed.