IAM roles should not allow untrusted GitHub Actions to assume them

iam
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

When a GitHub Action needs to assume an IAM role, it is recommended to use identity federation to avoid using hardcoded, long-lived credentials.

However, in some cases the trust policy of the role may be misconfigured and allow any untrusted GitHub Action to assume the IAM role.

Rationale

If the role trust policy does not have a properly configured condition, any untrusted GitHub Action from any repository (including outside your organization) can assume the role and retrieve credentials to your AWS account.

Remediation

Ensure that the IAM role has a condition on the token.actions.githubusercontent.com:sub condition key, for instance:

{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Effect": "Allow",
        "Principal": {
          "Federated": "arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
          "StringEquals": {
            "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
          },
          "StringLike": {
            "token.actions.githubusercontent.com:sub": "repo:your-organization/your-repository:*"
          }
        }
    }
  ]
}

See “Configuring the role trust policy” and “Example subject claims” in the GitHub documentation for more examples.

From the console

  1. In the AWS Console, navigate to the IAM role you would like to change.
  2. On the IAM role page, click the Trust relationships tab.
  3. Click Edit trust policy.
  4. Make changes to the trust policy, as shown in the previous section.
  5. Click Update policy.

From the command line

Using update-assume-role-policy, update the role trust policy to remediate the risk.

aws iam update-assume-role-policy
   --role-name Test-Role
   --policy-document file://<NEW_ROLE_POLICY>.json