GitHub OIDC role leaves the branch or environment open with a wildcard

What it checks

GitHub OIDC role leaves the branch or environment open with a wildcard

Where it applies

Terraform: aws_iam_role

CloudFormation: AWS::IAM::Role

How to fix it

1. Replace the wildcard after the repository name — ":*", ":ref:*", ":ref:refs/heads/*", ":environment:*" or a prefix such as ":ref:refs/heads/release-*" — with the ref written out in full, e.g. "repo:my-org/my-repo:ref:refs/heads/main".
2. Prefer an environment scope — "repo:my-org/my-repo:environment:production" — so GitHub's environment protection rules and required reviewers gate the assumption too.
3. If several refs legitimately deploy, list them explicitly or use one role per environment rather than widening back to a wildcard.

Frameworks

• SOC 2 CC6.1
• SOC 2 CC6.3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules