使用AWS re:Post即您表示您同意 AWS re:Post 使用条款

IAM Access Analyzer - alert on roles assumed by federated github actions

0

I would like IAM Access Analyzer to alert me when a role is permitted to be assumed by GitHub. Backround: I'm using GitHub actions, which use OIDC to assume roles in my AWS account. IAM Access Analyzer does allow me to define archive rules using the OIDC principal, which is part of the solution. But I also want to check that the roles are limiting based on conditions, such as the repo name. At the moment, it appears only Facebook/Google/Amazon/Cognito is supported. This is what I'd like to check for:

        "Effect": "Allow",
        "Principal": {
            "Federated": "arn:aws:iam::xxxx:oidc-provider/token.actions.githubusercontent.com"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
            "StringLike": {
                "token.actions.githubusercontent.com:sub": "repo:mygithuborg/mygithubrepo:*"
            }
        }
已提问 3 年前663 查看次数
1 回答
0

Hi,

Thank you for contacting us! I understand that you'd like IAM Access Analyzer to support archiving based on federation with GitHub, and for it to support filtering with condition keys for repositories and sub key. Please correct me if I have misunderstood your concern.

While the service does not yet support those condition key filters [1], we have an option to create a rule with the 'principal.Federated' criterion (it's called 'Federated User' on the console) to filter by the IdP ARN (which is arn:aws:iam::xxxx:oidc-provider/token.actions.githubusercontent.com in your case). From your correspondence I understand that you are aware of this option.

I thank you for your feedback on the service and I shall create a feature request to support your use case. While we do not have an ETA for now, please feel free to keep track of such feature releases on our What's New [2] page for when they arrive.

Let us know if you run into any further questions or concerns!

AWS
专家
已回答 3 年前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则