Open-source CLI

CLI quick start

Scan your AWS IAM roles for GitHub Actions OIDC misconfigurations from your terminal in minutes — open source, no account required.

oidc-audit is TrustFix's free, open-source scanner. It checks your AWS IAM roles for GitHub Actions OIDC trust-policy misconfigurations from your terminal or CI — no account required, and nothing is written to your AWS environment. (For the full platform, see the platform quick start.)

1. Run it

The fastest path uses your existing AWS credentials:

npx oidc-audit scan

It scans the IAM roles your credentials can read and prints the OIDC misconfigurations it finds, severity-rated. Add --json for machine-readable output in CI.

2. Required IAM permissions

The scanner needs only read access to IAM roles:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:ListRoles", "iam:GetRole"],
      "Resource": "*"
    }
  ]
}

It never writes to your account and never stores credentials.

3. Scope it to an account or profile

# Use a specific AWS profile
npx oidc-audit scan --profile production

# Cross-account scan with an assumed role
npx oidc-audit scan --role-arn arn:aws:iam::123456789012:role/AuditRole

# Filter by minimum severity
npx oidc-audit scan --severity HIGH

See the CLI reference for every flag and the detection reference for what each finding means.

4. Run it in CI

oidc-audit is also a GitHub Actions step, so you can scan on every push and pull request. View it on the GitHub Marketplace →