GCP GitHub Actions OIDC trust policy is insecurely configured misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_125
Category	IAM
Provider	GCP
Severity	HIGH
Framework	Terraform, Terraform Plan

Impact

This rule detects whether GCP GitHub Actions OIDC trust policies are insecurely configured, potentially allowing security vulnerabilities. Misconfigured policies can allow unauthorized access or introduce potential exploits via wildcards, abusable claims, or improperly formatted repository claims.

How to Fix

Resource: google_iam_workload_identity_pool_provider

• Arguments: role

To mitigate this issue, make sure your google_iam_workload_identity_pool_provider resource is properly configured without insecure claims.

• Avoid wildcards (*) or unsafe claim structures.
• Ensure claims follow safe and restricted formats. Abusable claims include: "workflow", "environment", "ref", "context", "head_ref", "base_ref"
• Use a specific repository reference.

Example: [source,go]

resource "google_iam_workload_identity_pool_provider" "example" { ... issuer_uri = "https://token.actions.githubusercontent.com" attribute_mapping = { "google.subject" = "assertion.sub" }

• attribute_condition = "assertion.sub == 'repo:*'"
• attribute_condition = "assertion.sub == 'repo:organization/repository'" }

---