warolv / igorzhivilo.com

igorzhivilo.com blog

Hi there 👋 My name is Igor.

DevOps tech lead at Cynerio.

Enjoy to build infrastructire and also to break.

Passionate about k8s, cloud & cyber security

My Blog: https://igorzhivilo.com

My Youtube channel: https://www.youtube.com/@igorzhivilo

• 🔭 I’m currently learning some modules for CDSA (HTB Certified Defensive Security Analyst)
• 🔭 Hands on k8s and AWS security tools: Falco | LinkerD | AWS Guard duty | playing with different container escape techniques.
• 📫 How to reach me: Twitter: @warolv, email: [email protected], LinkedIn: https://www.linkedin.com/in/igorzhivilo/

igorzhivilo.com's Issues

Subject conditions in Github roles

Hi there 👋🏻

I came across some of your posts, including this one: https://igorzhivilo.com/github-actions/github-actions-openid-aws/

I wanted to mention that it's very important to add a "subject" claim for token.actions.githubusercontent.com:sub. Otherwise, anyone could create a Github repository and use your role if they know the role's ARN.

You can add a subject condition like this:

            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": [
                        "sts.amazonaws.com"
                    ],
                   "token.actions.githubusercontent.com:sub": "repo:your-org/your-repo:*"
                }
            }

See this article for a longer explanation: https://medium.com/tinder/identifying-vulnerabilities-in-github-actions-aws-oidc-configurations-8067c400d5b8

Happy coding! 🥳