AWS GitHub Actions OIDC authorization policies allow for unsafe claims or claim order on IAM role mi

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_393
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	HIGH
Framework	Terraform, Terraform Plan

Impact

This rule detects whether an aws_iam_role resource whose trust policy (assume_role_policy) uses GitHub Actions OIDC authorization is configured with potentially unsafe claims or claim orders. Misconfigured claims can lead to security vulnerabilities by allowing unauthorized access or unsafe token usage, potentially resulting in privilege escalation or abuse.

This is the resource-level counterpart of CKV_AWS_358, which inspects data "aws_iam_policy_document" blocks; this rule applies the same logic to IAM roles that define their trust policy inline.

Specifically, the rule checks for:

• Missing or invalid conditions on the sub variable.
• Wildcard values or generic claims that could be abused.
• Unsafe claim formats or orders in the sub variable.

How to Fix

Resource: aws_iam_role

• Argument: assume_role_policy

To mitigate this issue, ensure the trust policy condition in the aws_iam_role resource:

• Avoids wildcards (*) or unsafe claim structures
• Ensures claims follow safe and restricted formats. Abusable claims include: "workflow", "environment", "ref", "context", "head_ref", "base_ref"
• Uses a specific repository reference.

Example: [source,go]

resource "aws_iam_role" "example" { name = "example" assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [{ Effect = "Allow" Action = "sts:AssumeRoleWithWebIdentity" Principal = { Federated = "arn:aws:iam::123456123456:oidc-provider/token.actions.githubusercontent.com" } Condition = { StringEquals = {

•      "token.actions.githubusercontent.com:sub" = "*"

•      "token.actions.githubusercontent.com:sub" = "repo:myOrg/myRepo:*"

} } }] }) }