hard20 pts · first answer countsidentity-securityworkload-identity

GitHub OIDC role without a sub check

An AWS role trusts GitHub's OIDC provider and its trust policy checks only that the token's aud is sts.amazonaws.com. What is the risk, and the fix?

A.Tokens expire too fast; raise the session duration to 12 hoursB.Workflows in other repos could assume it; restrict the sub claimC.GitHub will reject the role; add an access key as fallbackD.Only public repos can use it; switch to a client secret

Discussion 0

Join free to post in the discussion.

GitHub OIDC role without a sub check

Discussion 0

Related questions