From 892580d7d7c6564992a56f96a72bda90b53015f0 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Mon, 28 Sep 2026 18:38:19 +0000
Subject: [PATCH] fix(iam): match org-baseline policy-check OIDC subject
 (PLAT-234) (#155)

Pull request tokens use repo:ORG/seahaven-org-baseline:pull_request.
Merge queue tokens use the gh-readonly-queue ref. The previous
refs/pull/* subject never matched either.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
---
 oidc-deploy-roles.yaml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/oidc-deploy-roles.yaml b/oidc-deploy-roles.yaml
index d1e8782..17137c1 100644
--- a/oidc-deploy-roles.yaml
+++ b/oidc-deploy-roles.yaml
@@ -1177,6 +1177,18 @@ Resources:
       AssumeRolePolicyDocument:
         Version: "2012-10-17"
         Statement:
+          - Effect: Allow
+            Principal:
+              Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
+            Action: sts:AssumeRoleWithWebIdentity
+            # pull_request jobs with no environment use sub
+            # repo:ORG/seahaven-org-baseline:pull_request. refs/pull/N/merge is
+            # the ref claim, not sub. A second statement is required: StringEquals
+            # and StringLike in one condition are AND.
+            Condition:
+              StringEquals:
+                token.actions.githubusercontent.com:aud: sts.amazonaws.com
+                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-org-baseline:pull_request
           - Effect: Allow
             Principal:
               Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com
@@ -1185,11 +1197,7 @@ Resources:
               StringEquals:
                 token.actions.githubusercontent.com:aud: sts.amazonaws.com
               StringLike:
-                token.actions.githubusercontent.com:sub:
-                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
-                  # use_immutable_subject is false, so pull_request tokens use
-                  # repo:ORG/seahaven-org-baseline:ref:refs/pull/N/merge.
-                  - !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/pull/*
+                token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/gh-readonly-queue/main/*
       Policies:
         - PolicyName: access-analyzer-policy-check
           PolicyDocument: