v0.15 is out: rules that were silently dropped on the shipped engine now run, and scans skip your test and mock files by default. Read more →
HIGH AI PREVALENCE: HIGH auth.iac.gha-oidc-wildcard-sub

This AWS IAM trust policy federates GitHub Actions OIDC (token.actions.githubusercontent.com) but pins the sub claim to a wildcard pattern, so any repository, branch, or pull request matching the glob can assume this role.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

A leaked or malicious workflow in a matching repo gets your cloud credentials. Pin sub to an exact ref, for example repo:ORG/REPO:ref:refs/heads/main or repo:ORG/REPO:environment:prod, and keep the aud condition on sts.amazonaws.com. Scope one role per repository/environment rather than one wildcard role for many.

VULNERABLE
vulnerable.json
{
  "_oauthlint": "// ruleid: auth.iac.gha-oidc-wildcard-sub",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:my-org/*:*"
        }
      }
    }
  ]
}
SAFE
safe.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:my-org/my-repo:ref:refs/heads/main"
        }
      }
    }
  ]
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.iac.gha-oidc-wildcard-sub -- <reason>

References

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect ↗https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services ↗