AVOIDING MISTAKES WITH AWS OIDC INTEGRATION CONDITIONS

Summary from the TLDR InfoSec newsletter

This article discusses a critical security issue with AWS OpenID Connect (OIDC) integrations where missing or incorrectly configured conditions in IAM role trust policies could allow unauthorized access to AWS accounts. The article explains that while the "sub" condition is commonly known to be required (especially for GitHub Actions), different vendors may require different or additional conditions, such as Microsoft Defender requiring "sts:RoleSessionName" or some vendors using custom conditions. The key recommendation is that AWS customers should ensure all their OIDC integrations have both "aud" and "sub" conditions (unless vendor documentation specifically indicates otherwise) and investigate any exceptions carefully, as there are many vendors that work differently and some even recommend additional security measures like IP address restrictions.