AWS Access
The GitHub OIDC trust relationship
Access is federated through GitHub OIDC and pinned to one repository and one branch, so no AWS access key is created or stored anywhere.
The role you create trusts a web identity, not a user and not an access key. There is no credential to store, rotate, leak or forget.
How an assessment obtains access
- The assessment run requests a short-lived OIDC token from GitHub.
- It presents that token to AWS STS, asking to assume your role.
- AWS validates the token against the identity provider in your account, and checks
the token's claims against your role's trust policy.
- If every claim matches, STS returns temporary credentials valid for at most one
hour.
No part of this involves a secret shared between you and GovIntel.
The two claims that are pinned
The trust policy checks two things about the token.
The subject — which repository and which branch the run came from:
repo:<owner>/<repo>:ref:refs/heads/mainA token from any other repository, or from a branch other than the one named, fails the condition and the role is not assumed. The exact owner and repository name are written into your own trust policy when the stack is created, so you can read them in your IAM console at any time.
The audience — who the token was minted for:
sts.amazonaws.comThis is what stops a token issued for some other purpose being replayed against your account.
What else the trust policy enforces
| Constraint | Effect |
|---|---|
| Session name pattern | Sessions must be named govintel-*, so your CloudTrail can attribute every action |
| Maximum session duration | One hour |
| Engagement expiry | After the date you set, the role denies everything |
| Web identity only | A direct sts:AssumeRole from an IAM user or role is refused |