News for hackers. Stuff that matters.

A comment on AWS federation comes to GitHub Actions. Parent comment

Re:AWS federation comes to GitHub Actions by Deathmax on Wednesday September 15, 2021 @08:31AM (#28538235)
There's a lack of documentation since this isn't officially released yet, but my assumption is that you need write permissions to id-token in order to generate a JWT. As forked repos can at most get read access[1], presumably that would prevent a malicious fork job from generating the JWT.

[1]: https://docs.github.com/en/actions/reference/authentication-...

[ Parent | on HN ]
Re:AWS federation comes to GitHub Actions by chrisrpatterson on Wednesday September 15, 2021 @09:05AM (#28538587)
Yes a malicious fork will NOT be able to get a JWT just like they are not able to get any other secrets or privledges to the repo.
[ Parent | on HN ]
Re:AWS federation comes to GitHub Actions by jffry on Wednesday September 15, 2021 @10:44AM (#28539746)
I was going to ask for a source, but I saw you've commented in the past that you're the GitHub Actions product manager.

This looks like a great feature to help keep long-lived AWS secrets out of my builds entirely.

[ Parent | on HN ]