A security community success story of mitigating a misconfiguration
wiz.io | blog | #cloud | #cloud-security | #aws | #github-actions | #misconfiguration | #iam | #oidc
Summary
The story of fixing a common misconfiguration: GitHub Actions OIDC trust policies missing their 'sub' condition let anyone assume AWS roles, until coordinated research pushed defaults to change.
- Published
- Collected
--- id: 7263 title: "A security community success story of mitigating a misconfiguration" source_domain: wiz.io source_url: "https://www.wiz.io/blog/a-security-community-success-story-of-mitigating-a-misconfiguration" published_at: "2023-09-08T18:47:43Z" tags: ["cloud", "cloud-security", "aws", "github-actions", "misconfiguration", "iam", "oidc"] phying_url: "https://phying.com/item/7263" lang: en --- # A security community success story of mitigating a misconfiguration ## Summary The story of fixing a common misconfiguration: GitHub Actions OIDC trust policies missing their 'sub' condition let anyone assume AWS roles, until coordinated research pushed defaults to change. ## Intelligence Metadata - **Sources:** wiz.io - **Published:** 2023-09-08T18:47:43Z - **Original:** https://www.wiz.io/blog/a-security-community-success-story-of-mitigating-a-misconfiguration - **Phying News:** https://phying.com/item/7263