AWS Moves to Block Misconfigured GitHub Actions IAM Roles

Summary

A missing repository condition in AWS IAM trust policies could let any GitHub repository assume a role. AWS improved its setup flow and began blocking new misconfigured policies; HashiCorp also announced Terraform-related measures.

Key points

A missing `sub` condition in an AWS IAM role trust policy could allow a GitHub Actions workflow from any repository to assume the role and access the AWS account.
Duplicate keys in Terraform JSON can be silently ignored, potentially causing the repository restriction to be omitted; an incorrect tutorial may also have spread the configuration mistake.
The author created a honeypot to check for automated exploitation and reported no abuse of it as of publication.
AWS updated its console wizard and emailed affected customers. Its Access Analyzer Policy Validator also warned about missing GitHub repository conditions during manual policy edits.
On September 6, 2023, AWS said new trust policies could no longer be created with the misconfiguration; existing policies were to remain functional but require the `sub` condition by November 1.
HashiCorp issued a security bulletin and said it was working on a Terraform warning; it also released Semgrep rules to detect the issue.

Article Details

Event Type: Security community remediation of an AWS IAM trust-policy misconfiguration affecting GitHub Actions integrations.
Impact: Missing the sub condition in an IAM role trust policy could allow a GitHub Actions workflow from any repository to assume the role and access the affected AWS account. AWS deployed a console wizard change, notified affected customers, and blocked creation of new roles with the misconfiguration; existing affected roles remained usable until the announced November 1 enforcement.

Vendors

Amazon Web ServicesIn the past few months, there has been a lot of activity among security researchers identifying AWS IAM Roles that were intended to be accessed only from Github Actions associated with specific repos, but were HashiCorpAccess Analyzer Policy Validator error messageStep 5: I reached out to Hashicorp’s security team to ensure they too were aware of the specific issue with terraform and how it can lead to security problems.

Products

IAM Access AnalyzerAWS email from August 18AWS already has had Access Analyzer Policy Validator checks, so when you manually edit an IAM Role trust policy in the web console, there have been warnings for missing the Github repo conditions.TerraformGithub repos or committing some other user error. But the post from Datadog identified an issue in Terraform that could result in this problem. The issue is that if the JSON in terraform has two elements in a

Tools

SemgrepHashicorp has released a security bulletin about this, initiated efforts to have terraform emit a warning when it encounters this issue, and released semgrep rules to detect it.