← All keys & policies
Outside GitHub·repository
Cloud OIDC trust policy for GitHub Actions
Tier 1 · HighManagement
Why Tier 1
Takes the tier of the cloud role it lets workflows assume. The subject (sub) condition decides which workflows can: a wildcard on the repository, branch or environment lets workflows nobody reviewed assume the role.
The trust policy in AWS, Azure or Google Cloud that accepts GitHub's OIDC token for a cloud role.
Available on: Every setup. Source
Attack path
A trust policy that matches repo:org/* or any branch lets a workflow from any repository or pull request branch in the organization get cloud credentials, skipping environment reviewers.
Mitigations
- Match the full subject, including the environment, in every trust policy
- Use environments with required reviewers for roles that can deploy
Detect
Nothing in the organization or enterprise audit log shows this. Review it on a schedule instead.