From 62a228c42b440ff39d07c5bcd365ecbf0ba3ec9b Mon Sep 17 00:00:00 2001 From: tiennm99 Date: Mon, 18 May 2026 16:57:04 +0700 Subject: [PATCH] fix(security): narrow OIDC trust to main only (F2) Drop refs/heads/dev and pull_request from the sub allowlist on github-deploy-miti99bot trust policy. Only pushes to main can now assume the deploy role. dev was dormant (ci.yml has only contents:read; deploy.yml triggers on push:main only). pull_request was dormant too (no workflow has id-token:write under PR trigger). This closes the latent F2 path. Plan: plans/260518-1019-iam-least-privilege/phase-01-narrow-oidc-trust-f2.md Audit: plans/reports/code-reviewer-260518-1019-security-aws-infra.md --- aws/iam-github-oidc-trust.json | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/aws/iam-github-oidc-trust.json b/aws/iam-github-oidc-trust.json index 1fd30ad..b21576d 100644 --- a/aws/iam-github-oidc-trust.json +++ b/aws/iam-github-oidc-trust.json @@ -13,9 +13,7 @@ }, "StringLike": { "token.actions.githubusercontent.com:sub": [ - "repo:tiennm99/miti99bot:ref:refs/heads/main", - "repo:tiennm99/miti99bot:ref:refs/heads/dev", - "repo:tiennm99/miti99bot:pull_request" + "repo:tiennm99/miti99bot:ref:refs/heads/main" ] } }