Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

GitHub OIDC federated role allows assumption from any repository in an org

AWS_IAM_009 HIGH Security

What it checks

GitHub OIDC federated role allows assumption from any repository in an org

Where it applies

Terraform: aws_iam_role

CloudFormation: AWS::IAM::Role

How to fix it

  1. Replace the repository wildcard ("repo:my-org/*", or a prefix such as "repo:my-org/my-repo*") with the repository name written out in full: "repo:my-org/my-specific-repo:*".
  2. If multiple repos legitimately need this role, create a separate role per repo — each scoped to its repository path.

Vendor documentation

All rules