GitHub OIDC federated role allows assumption from any GitHub repository

What it checks

GitHub OIDC federated role allows assumption from any GitHub repository

Where it applies

Terraform: aws_iam_role

CloudFormation: AWS::IAM::Role

How to fix it

1. Replace the wildcard account ("repo:*", or a prefix such as "repo:my-org*") with the full repository path that should deploy: "repo:my-org/my-repo:*". This scopes the trust to a single repository. Write the account name out in full — a prefix still matches other accounts.
2. Optionally add a StringEquals condition on the ref ("repo:my-org/my-repo:ref:refs/heads/main") to restrict to a specific branch.

Frameworks

• SOC 2 CC6.1
• SOC 2 CC6.3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules