Locking down GitHub Actions to specific Repo with OIDC

[lukewelden-mobysoft]

Hey, people!

I'm having problems authenticating a GitHub Actions workflow to my AWS environment when a specific repo is specified in my AWS role's trust policy. I've had a read through https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services and I believe I've set it up correctly but it's still having problems.

Github workflow

name: Configure AWS Credentials 
uses: aws-actions/configure-aws-credentials@v1 
with: 
  aws-region: eu-west-1 
  role-to-assume: arn:aws:iam::<AWSACCOUNTID>:role/HermesHR-GitHubActions-Role 
  role-session-name: GithubActionWorkflow

AWS Role Trust Policy

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::<AWSACCOUNTID>:oidc-provider/token.actions.githubusercontent.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" }, "StringLike": { "token.actions.githubusercontent.com:sub": "repo:mobysoft/hermeshr:*" } } } ] }

As soon as I change the AWS Role trust policy to the below code it authenticates without issue. So there's something going wrong when I'm trying to lock it down the project's repo.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::<AWSACCOUNTID>:oidc-provider/token.actions.githubusercontent.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" }, "StringLike": { "token.actions.githubusercontent.com:sub": "repo:mobysoft/*" } } } ]

Am I doing something wrong?

[peterwoodworth]

Sorry for the delayed response @lukewelden-mobysoft,

It does appear as if you are setting up the sub claim correctly in the trust policy. I'm curious if you can share what exactly is triggering this workflow? If you share the full workflow file we could see if some configurations to your workflow are modifying the sub claim.

I'd be curious if you could test this on any other repo/org combinations. Maybe testing this out individually might reveal some mistake you might have made when configuring this for the affected repo

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.