v0.15 is out: rules that were silently dropped on the shipped engine now run, and scans skip your test and mock files by default. Read more →
HIGH AI PREVALENCE: MEDIUM auth.iac.gha-oidc-missing-sub

This AWS IAM trust policy federates GitHub Actions OIDC (token.actions.githubusercontent.com) with an aud condition but sets no sub condition at all, so ANY GitHub repository, owned by anyone, can assume this role.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

The audience check alone is shared by every GitHub Actions token and does not identify your repo. Add a StringEquals (or StringLike, still pinned) condition on token.actions.githubusercontent.com:sub bound to your repository and ref, for example repo:ORG/REPO:ref:refs/heads/main. Without it the role is effectively public to all of GitHub.

VULNERABLE
vulnerable.json
{
  "_oauthlint": "// ruleid: auth.iac.gha-oidc-missing-sub",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        }
      }
    }
  ]
}
SAFE
safe.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
          "token.actions.githubusercontent.com:sub": "repo:my-org/my-repo:ref:refs/heads/main"
        }
      }
    }
  ]
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.iac.gha-oidc-missing-sub -- <reason>

References

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect ↗https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services ↗