Identifying vulnerabilities in GitHub Actions & AWS OIDC Configurations

Summary

In 2021, GitHub released OpenID Connect support for GitHub Actions to let workflows retrieve short-lived cloud session tokens instead of storing static secrets. Tinder Security Labs discovered widespread IAM role misconfigurations that allow external repositories to assume target roles and access AWS resources. The primary issue stems from IAM trust policies that authenticate the GitHub identity provider but omit strict validation on the subject claim. Researchers located exposed role identifiers via public workflow searches and confirmed that arbitrary external GitHub Actions workflows could assume them, including roles within AWS official repositories. Remediation requires configuring trust policies to restrict the audience and validate repository namespaces, while unauthorized assumptions can be detected in CloudTrail logs.

Takeaways

1. 1

   Omission of the subject (sub) claim check in an AWS IAM trust policy allows any arbitrary GitHub repository to assume the role via GitHub Actions OIDC.

2. 2

   Successful role assumption events are recorded in AWS CloudTrail logs, where the username attribute includes the requesting repository and organization name.

3. 3

   Securing OIDC IAM roles requires configuring trust policies to enforce exact audience values and strict repository namespace matching in the subject claim.