Open-source CLI

Detection reference

The OIDC trust-policy misconfigurations the open-source oidc-audit CLI detects in GitHub Actions roles — what each finding means, and how to fix it.

The open-source oidc-audit CLI scans AWS IAM roles for GitHub Actions OIDC trust-policy misconfigurations. Each finding below is severity-rated; use --severity to filter the output.

Finding	What it detects	Severity
`MISSING_SUB_CLAIM`	Trust policy has no `sub` condition — any GitHub repo can assume the role	CRITICAL
`WILDCARD_SUB_CLAIM`	Overly permissive wildcard in the `sub` claim (``, `repo:`) — matches unintended repositories	CRITICAL
`MISSING_AUD_CLAIM`	No `aud` condition — tokens minted for any OIDC client are accepted	HIGH
`ORG_WIDE_TRUST`	`sub` allows any repository in an organization (`repo:myorg/*`)	HIGH
`PULL_REQUEST_ALLOWED`	Allows `pull_request` events, so a fork PR can mint a token and assume the role	HIGH
`FORKED_REPO_ALLOWED`	May allow forked repositories	HIGH
`REF_TYPE_MISSING`	No branch/tag restriction in the `sub` claim	MEDIUM
`ENVIRONMENT_NOT_REQUIRED`	No GitHub Environment requirement, bypassing protection rules and required reviewers	MEDIUM
`WORKFLOW_NOT_PINNED`	Not pinned to a specific workflow file	MEDIUM
`ACTOR_NOT_RESTRICTED`	No actor/user restriction	LOW

Vulnerable policy example

// ❌ Any repo can assume this role
"Condition": { "StringLike": {
  "token.actions.githubusercontent.com:sub": "repo:*:*"
} }

Fixed policy example

// ✓ Only your repo, only your branch
"Condition": { "StringEquals": {
  "token.actions.githubusercontent.com:sub": "repo:myorg/myrepo:ref:refs/heads/main"
} }

The full TrustFix platform detects a much wider range of NHI and agent-identity risk — over-privileged CI/CD and AI-agent roles, cross-account trust, static credentials, toxic combinations, and more — and proves a fix is safe before opening a PR. See what TrustFix is.

← oidc-audit CLI FAQ →