jprdonnelly/docs
1
0
Fork 0
mirror of synced 2025-12-30 03:01:36 -05:00
Code Issues Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source
This commit is contained in:
Martin Lopes
2022-09-09 15:21:46 +10:00
committed by GitHub
parent d241929c1f
commit 30de2a042e
2 changed files with 2 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@@ -2,7 +2,6 @@
.DS_Store
.env
.vscode/settings.json
*.code-workspace
.idea/
/node_modules/
npm-debug.log

9
content/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services.md
View File

@@ -39,8 +39,7 @@ To add the {% data variables.product.prodname_dotcom %} OIDC provider to IAM, se
To configure the role and trust in IAM, see the AWS documentation for ["Assuming a Role"](https://github.com/aws-actions/configure-aws-credentials#assuming-a-role) and ["Creating a role for web identity or OpenID connect federation"](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html).
Edit the trust policy to add the `sub` field to the validation conditions.
For example:
Edit the trust policy to add the `sub` field to the validation conditions. For example:
```json{:copy}
"Condition": {
@@ -51,11 +50,7 @@ For example:
}
```
A more complete, practical example is shown below.
Here `ForAllValues` is used to match on multiple condition keys and `StringLike` is used to match any ref on the specified repo.
Note that `ForAllValues` is [overly permissive](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html) and should not be used alone on an `Allow` effect.
In this example, the inclusion of `StringLike` means that an empty set in `ForAllValues` will still not pass the condition.
In the following example, `ForAllValues` is used to match on multiple condition keys, and `StringLike` is used to match any ref in the specified repository. Note that `ForAllValues` is [overly permissive](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html) and should not be used on its own in an `Allow` effect. For this example, the inclusion of `StringLike` means that an empty set in `ForAllValues` will still not pass the condition:
```json{:copy}
{