From cc9b55208feebb390f20ab3e6e1e1ca855946490 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Tue, 22 Sep 2026 16:24:39 -0400 Subject: [PATCH] fix(iam): drop githubdeploy workflow_ref OIDC condition AWS STS does not evaluate GitHub workflow_ref, so that trust condition fail-closes AssumeRoleWithWebIdentity. --- terraform/iam_github_deploy.tf | 11 ++--------- tests/test_terraform_github_deploy.py | 24 ++++-------------------- 2 files changed, 6 insertions(+), 29 deletions(-) diff --git a/terraform/iam_github_deploy.tf b/terraform/iam_github_deploy.tf index 08e08d2..52ae70c 100644 --- a/terraform/iam_github_deploy.tf +++ b/terraform/iam_github_deploy.tf @@ -27,6 +27,8 @@ data "aws_iam_policy_document" "github_deploy_assume" { ] } + # AWS STS GitHub condition keys include job_workflow_ref, not workflow_ref. + # A workflow_ref condition fail-closes AssumeRoleWithWebIdentity. condition { test = "StringLike" variable = "token.actions.githubusercontent.com:job_workflow_ref" @@ -34,15 +36,6 @@ data "aws_iam_policy_document" "github_deploy_assume" { "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*", ] } - - condition { - test = "StringLike" - variable = "token.actions.githubusercontent.com:workflow_ref" - values = [ - "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main", - "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*", - ] - } } } diff --git a/tests/test_terraform_github_deploy.py b/tests/test_terraform_github_deploy.py index e0491d9..4eb49b8 100644 --- a/tests/test_terraform_github_deploy.py +++ b/tests/test_terraform_github_deploy.py @@ -1,4 +1,4 @@ -"""githubdeploy OIDC trust pins the org reusable and the thin caller.""" +"""githubdeploy OIDC trust pins the org reusable with AWS-supported claims.""" from pathlib import Path @@ -11,25 +11,9 @@ def test_github_deploy_trust_uses_org_reusable_and_caller(): assert "repo:Sea-Haven-Industries/meal-order-manager:environment:dev" in text assert "repo:Sea-Haven-Industries/meal-order-manager:environment:prod" in text assert ( - "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*" in text - ) - assert "token.actions.githubusercontent.com:workflow_ref" in text - assert ( - "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main" - in text - ) - assert ( - "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*" - in text - ) - assert "cd-hcp-spa.yaml" not in text - assert "token.actions.githubusercontent.com:workflow_ref" in text - assert ( - "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/heads/main" - in text - ) - assert ( - "Sea-Haven-Industries/meal-order-manager/.github/workflows/deploy-api.yaml@refs/tags/v*" + "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*" in text ) + assert "token.actions.githubusercontent.com:job_workflow_ref" in text + assert "token.actions.githubusercontent.com:workflow_ref" not in text assert "cd-hcp-spa.yaml" not in text