- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
When a GitHub Action needs to assume an IAM role, it is recommended to use identity federation to avoid using hardcoded, long-lived credentials.
However, in some cases the trust policy of the role may be misconfigured and allow any untrusted GitHub Action to assume the IAM role.
If the role trust policy does not have a properly configured condition, any untrusted GitHub Action from any repository (including outside your organization) can assume the role and retrieve credentials to your AWS account.
Ensure that the IAM role has a condition on the token.actions.githubusercontent.com:sub
condition key, for instance:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
},
"StringLike": {
"token.actions.githubusercontent.com:sub": "repo:your-organization/your-repository:*"
}
}
}
]
}
See “Configuring the role trust policy” and “Example subject claims” in the GitHub documentation for more examples.
Using update-assume-role-policy
, update the role trust policy to remediate the risk.
aws iam update-assume-role-policy
--role-name Test-Role
--policy-document file://<NEW_ROLE_POLICY>.json