jprdonnelly/docs
1
0
Fork 0
mirror of synced 2026-01-06 06:02:35 -05:00
Code Issues Projects Releases Wiki Activity

Merge pull request #23206 from github/repo-sync

Browse Source 
repo sync
This commit is contained in:
Octomerger Bot
2021-11-30 05:57:16 -05:00
committed by GitHub
parent db1d183750 ba382b2039
commit 2eb3f35913
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
content/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services.md
View File

@@ -38,12 +38,11 @@ To add the {% data variables.product.prodname_dotcom %} OIDC provider to IAM, se
To configure the role and trust in IAM, see the AWS documentation for ["Assuming a Role"](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role) and ["Creating a role for web identity or OpenID connect federation"](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html).
By default, the validation only includes the audience (`aud`) condition, so you must manually add a subject (`sub`) condition. Edit the trust relationship to add the `sub` field to the validation conditions. For example:
Edit the trust relationship to add the `sub` field to the validation conditions. For example:
```json{:copy}
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "https://github.com/octo-org",
"token.actions.githubusercontent.com:sub": "repo:octo-org/octo-repo:ref:refs/heads/octo-branch"
}
}
@@ -86,7 +85,7 @@ env:
# permission can be added at job level or workflow level
permissions:
id-token: write
contents: write # This is required for actions/checkout@v1
contents: read # This is required for actions/checkout@v1
jobs:
S3PackageUpload:
runs-on: ubuntu-latest