Verification
Verify the access boundary
Read the deployed role in your own console and confirm the grants, the denials, the trust conditions and the expiry are what is documented.
The role is in your account. Everything below is readable in the IAM console without GovIntel's involvement.
1. The trust policy
Open the role, then the trust relationship. Confirm:
| Check | Expected |
|---|---|
| Principal type | A federated web identity, not a user, an account or a role |
| Audience condition | Pinned to the AWS security token service |
| Subject condition | Pinned to one repository and one branch |
| Session name condition | Session names constrained to a govintel- prefix |
| Expiry condition | No session may be issued after your engagement expiry |
A federated principal with no subject condition would mean any GitHub Actions workflow anywhere could assume the role. Confirm the condition is present.
2. The grants
Two AWS managed policies, and inline grants naming individual calls. Every inline action should be a describe, list, get-configuration or equivalent read.
Nothing should create, modify, delete, put, update, attach or invoke.
3. The denials
Confirm the deny policy is attached and covers:
- object and record content reads
- secrets, parameters and cryptographic operations
- log and stream content
- code and container image retrieval, and function invocation
- assuming other roles and passing roles
A deny in IAM overrides every allow, including those from the managed policies. That is what makes these binding rather than advisory.
4. The expiry
Two places: a condition on the trust policy, and a deny statement inside the role. Both should carry the date you set.
The second is not redundant. A session issued just before expiry remains valid for up to its maximum duration, and the deny is what stops it.
5. Maximum session duration
Confirm it is one hour rather than the longer values IAM permits.
Then revoke it and check
Delete the stack. Confirm the role is gone. This is the strongest verification available, and it costs one re-deploy.