adam/.github
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/.github.git synced 2026-09-30 07:03:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Trust seahaven-org-baseline sub on account-baseline deploy role

Browse source 
Transition pair for the repo rename: OIDC sub claims carry the repo full
name, so the renamed repo cannot assume the role until its sub is
trusted. Old sub is removed after a post-rename deploy verifies green.
This commit is contained in:
Adam Moussa 2026-07-14 13:27:42 -04:00
parent bb1c5f2e44
commit fc86079df9
No known key found for this signature in database
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
oidc-deploy-roles.yaml
View file

@ -1247,7 +1247,12 @@ Resources:
StringEquals: StringEquals:
token.actions.githubusercontent.com:aud: sts.amazonaws.com token.actions.githubusercontent.com:aud: sts.amazonaws.com
StringLike: StringLike:
token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/seahaven-account-baseline:ref:refs/heads/main # Transition pair for the seahaven-account-baseline ->
# seahaven-org-baseline repo rename (2026-07-14). The old sub is
# removed once a post-rename deploy is verified green.
token.actions.githubusercontent.com:sub:
- !Sub repo:${GitHubOrg}/seahaven-account-baseline:ref:refs/heads/main
- !Sub repo:${GitHubOrg}/seahaven-org-baseline:ref:refs/heads/main
Policies: Policies:
- PolicyName: cdk-deploy - PolicyName: cdk-deploy
PolicyDocument: PolicyDocument: