tiennm99/miti99bot
1
0
Fork 0
mirror of https://github.com/tiennm99/miti99bot.git synced 2026-09-14 12:18:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): narrow OIDC trust to main only (F2)

Browse Source 
Drop refs/heads/dev and pull_request from the sub allowlist on
github-deploy-miti99bot trust policy. Only pushes to main can now
assume the deploy role.

dev was dormant (ci.yml has only contents:read; deploy.yml triggers
on push:main only). pull_request was dormant too (no workflow has
id-token:write under PR trigger). This closes the latent F2 path.

Plan: plans/260518-1019-iam-least-privilege/phase-01-narrow-oidc-trust-f2.md
Audit: plans/reports/code-reviewer-260518-1019-security-aws-infra.md
This commit is contained in:
tiennm99
2026-05-18 16:57:04 +07:00
parent 0a048e8f5a
commit 62a228c42b
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
aws/iam-github-oidc-trust.json
+1 -3
View File
@@ -13,9 +13,7 @@
},
"StringLike": {
"token.actions.githubusercontent.com:sub": [
"repo:tiennm99/miti99bot:ref:refs/heads/main",
"repo:tiennm99/miti99bot:ref:refs/heads/dev",
"repo:tiennm99/miti99bot:pull_request"
"repo:tiennm99/miti99bot:ref:refs/heads/main"
]
}
}