Open source · Apache-2.0
oidc-audit
The open-source OIDC trust-policy scanner for AWS. Runs in your terminal, on your laptop, against your AWS account. Same finding types as the TrustFix platform — JSON output, no account required.
Quick start
- 1
Install
npm install -g oidc-audit - 2
Scan
oidc-audit scan --account 123456789012 - 3
JSON output
oidc-audit scan --json > findings.json
AWS credentials must be configured locally (e.g. aws sso login). oidc-audit only requires read-only IAM permissions — never any write or assume-role to a TrustFix-controlled role.
What it detects
A subset of the TrustFix detector catalog focused on the OIDC trust-policy attack surface — the highest-impact, lowest- false-positive checks we ship.
- ▸OIDC trust policies missing repository-specific sub conditions
- ▸OIDC StringLike-instead-of-StringEquals (wildcard tolerance)
- ▸OIDC missing audience condition
- ▸GitHub Actions fork-PR risk in trust policies
- ▸Cross-account trust without ExternalId
- ▸Wildcard principal in trust policy
What it doesn’t do (yet)
oidc-audit is the open-source subset. The full TrustFix platform handles these:
- ·Generate Terraform / CloudFormation fixes (full TrustFix platform)
- ·GCP Workload Identity Federation scanning
- ·Azure Entra ID Workload Identity Federation scanning
- ·GitLab + Bitbucket CI/CD pipeline scanning
- ·PIE 8-stage validation including Z3 SMT formal verification
- ·PR-shipped fixes to GitHub / GitLab / Bitbucket
Want the full platform?
451 detectors across 5 platforms, 8-stage validation including Z3 formal verification, fixes shipped as PRs to your code host. Currently invitation-only.