AWS federation comes to GitHub Actions

Re:AWS federation comes to GitHub Actions by joshuanapoli on Wednesday September 15, 2021 @07:18AM (#28537669)

Note that some Actions run with lower permission and cannot access GitHub Secrets. For example, actions triggered by Dependabot PRs cannot access secrets. This would normally prevent untrusted updates from testing/deploying on your AWS Account. Maybe federation would bypass these protections that depend on the identity triggering the action.

[ Parent | on HN ]

Re:AWS federation comes to GitHub Actions by Deathmax on Wednesday September 15, 2021 @08:31AM (#28538235)

There's a lack of documentation since this isn't officially released yet, but my assumption is that you need write permissions to id-token in order to generate a JWT. As forked repos can at most get read access[1], presumably that would prevent a malicious fork job from generating the JWT.

[1]: https://docs.github.com/en/actions/reference/authentication-...

[ Parent | on HN ]

Re:AWS federation comes to GitHub Actions by chrisrpatterson on Wednesday September 15, 2021 @09:05AM (#28538587)

Yes a malicious fork will NOT be able to get a JWT just like they are not able to get any other secrets or privledges to the repo.

[ Parent | on HN ]

Re:AWS federation comes to GitHub Actions by jffry on Wednesday September 15, 2021 @10:44AM (#28539746)

I was going to ask for a source, but I saw you've commented in the past that you're the GitHub Actions product manager.

This looks like a great feature to help keep long-lived AWS secrets out of my builds entirely.

[ Parent | on HN ]