mirror of
https://github.com/tiennm99/miti99bot.git
synced 2026-06-08 04:17:16 +00:00
tiennm99
148388e5a2
Drop refs/heads/dev and pull_request from the sub allowlist on github-deploy-miti99bot trust policy. Only pushes to main can now assume the deploy role. dev was dormant (ci.yml has only contents:read; deploy.yml triggers on push:main only). pull_request was dormant too (no workflow has id-token:write under PR trigger). This closes the latent F2 path. Plan: plans/260518-1019-iam-least-privilege/phase-01-narrow-oidc-trust-f2.md Audit: plans/reports/code-reviewer-260518-1019-security-aws-infra.md
23 lines
565 B
JSON
23 lines
565 B
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"Federated": "arn:aws:iam::225603493174:oidc-provider/token.actions.githubusercontent.com"
|
|
},
|
|
"Action": "sts:AssumeRoleWithWebIdentity",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
|
|
},
|
|
"StringLike": {
|
|
"token.actions.githubusercontent.com:sub": [
|
|
"repo:tiennm99/miti99bot:ref:refs/heads/main"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|