AWS IAM: Allow job_workflow_ref as GitHub Actions OIDC tenancy claim
Summary
Updates the secure-by-default OIDC IdP table so GitHub Actions can use either the 'sub' or 'job_workflow_ref' claim as the tenancy claim and required claim condition.
Security assessment
The change expands the trust-policy condition guidance for GitHub Actions OIDC role assumption, documenting an additional claim (job_workflow_ref) that can be used to scope which workflows may assume a role, which is security hardening guidance rather than a fix for a specific incident.
Evidence
[GitHub actions](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) | `https://token.actions.githubusercontent.com` | sub or job_workflow_ref | `token.actions.githubusercontent.com:sub` or `token.actions.githubusercontent.com:job_workflow_ref`
Diff
diff --git a/IAM/latest/UserGuide/id_roles_providers_oidc_secure-by-default.md b/IAM/latest/UserGuide/id_roles_providers_oidc_secure-by-default.md index 66893a6..5141e9f 100644 --- a//IAM/latest/UserGuide/id_roles_providers_oidc_secure-by-default.md +++ b//IAM/latest/UserGuide/id_roles_providers_oidc_secure-by-default.md @@ -40 +40 @@ OIDC IdP | OIDC URL | Tenancy Claim | Required Claims -[GitHub actions](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) | `https://token.actions.githubusercontent.com` | sub | `token.actions.githubusercontent.com:sub` +[GitHub actions](https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services) | `https://token.actions.githubusercontent.com` | sub or job_workflow_ref | `token.actions.githubusercontent.com:sub` or `token.actions.githubusercontent.com:job_workflow_ref`