# A security community success story of mitigating a misconfiguration

GitHub Actions OIDC trust policies missing the `sub` condition let any GitHub repo assume victim AWS IAM roles, granting account access.

- Payout: Research
- Severity: high
- Program: Amazon
- Write-up by: Wiz Research
- Disclosed: 2023-09-08
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/a-security-community-success-story-of-mitigating-a-misconfiguration
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-a-security-community-success-story-of-mitigating-a-misconfiguration
- Tags: area:cloud domain:cloud impact:internal-access kind:research platform:threat-intel sev:high tech:aws tech:github-actions tech:oidc technique:source-review vuln:auth-bypass vuln:misconfiguration

**Target:** AWS IAM role trust policy with GitHub OIDC provider
**Root cause:** Trust policy omits the `sub` condition restricting the token to a specific repo, so any GitHub repository's Actions token can assume the role. Terraform silently drops duplicate JSON keys, so a duplicated `sub` entry vanishes, producing this policy.
**Steps:**
1. Create a GitHub Actions workflow using `aws-actions/configure-aws-credentials` with the victim's role ARN and OIDC provider.
2. Obtain the OIDC token from GitHub Actions and call `sts:AssumeRoleWithWebIdentity` against the victim role.
3. Because the trust policy lacks a `sub` condition, the assume succeeds from any repo, yielding temporary AWS credentials.
**How found:** Researchers audited IAM role trust policies for GitHub OIDC integrations and noticed the `sub` condition missing; Datadog traced a root cause to Terraform's Go `encoding/json` silently dropping duplicate dictionary keys, and a top Google tutorial was found to contain the same mistake, explaining copy/paste spread.
**Exploitation:** Any attacker-controlled GitHub repo runs a workflow that requests a web identity token and assumes the misconfigured role, gaining the role's AWS permissions in the victim account.
**Insight:** When auditing OIDC trust policies, check for the `sub` condition specifically; also suspect duplicate JSON keys silently dropped by parsers (Go encoding/json) as a source of security-relevant config loss.