AWS IAM: Improved GitHub OIDC token condition key guidance
Summary
Added explicit guidance to specify GitHub branch in token.actions.githubusercontent.com:ref when subject claim lacks branch information
Security assessment
The change provides clearer security guidance to prevent overly permissive access by properly restricting GitHub OIDC tokens, reducing risk of unauthorized actions
Evidence
+Specify the repository in `token.actions.githubusercontent.com:sub`. You can specify the branch in that same value, or in a separate `token.actions.githubusercontent.com:ref` condition key. When the subject claim does not include the branch — for example, when it names a GitHub environment — specify the branch in `token.actions.githubusercontent.com:ref`.
Diff
diff --git a/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.md b/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.md index 630ff3bda..d97723d6b 100644 --- a//IAM/latest/UserGuide/access-analyzer-reference-policy-checks.md +++ b//IAM/latest/UserGuide/access-analyzer-reference-policy-checks.md @@ -3514 +3514 @@ In the AWS Management Console, the finding for this check includes the following - Specific github repo and branch recommended: Using a wildcard (*) in token.actions.githubusercontent.com:sub can allow requests from more sources than you intended. Specify the value of token.actions.githubusercontent.com:sub with the repository and branch name. + Specific github repo and branch recommended: Using a wildcard (*) in token.actions.githubusercontent.com:sub can allow requests from more sources than you intended. Specify the value of token.actions.githubusercontent.com:sub with the repository and branch name. If the subject claim does not include the branch, specify it in a token.actions.githubusercontent.com:ref condition key. @@ -3520 +3520 @@ In programmatic calls to the AWS CLI or AWS API, the finding for this check incl - "findingDetails": "Using a wildcard (*) in token.actions.githubusercontent.com:sub can allow requests from more sources than you intended. Specify the value of token.actions.githubusercontent.com:sub with the repository and branch name." + "findingDetails": "Using a wildcard (*) in token.actions.githubusercontent.com:sub can allow requests from more sources than you intended. Specify the value of token.actions.githubusercontent.com:sub with the repository and branch name. If the subject claim does not include the branch, specify it in a token.actions.githubusercontent.com:ref condition key." @@ -3525,0 +3526,2 @@ If you use GitHub as an OIDC IdP, best practice is to limit the entities that ca +Specify the repository in `token.actions.githubusercontent.com:sub`. You can specify the branch in that same value, or in a separate `token.actions.githubusercontent.com:ref` condition key. When the subject claim does not include the branch — for example, when it names a GitHub environment — specify the branch in `token.actions.githubusercontent.com:ref`. +