Skip to content

Conversation

@prdngr
Copy link

@prdngr prdngr commented Feb 9, 2026

Hi, this PR fixes a false positive in cape and role-trusts. In situations where the AWS trust policy of a GitHub Actions OIDC role verifies the sub claim, as shown below, CloudFox reported the trusted subject as "ALL REPOS!!!".

"Condition": {
    "ForAllValues:StringLike": {
        "token.actions.githubusercontent.com:sub": "repo:BishopFox/cloudfox:*"
    },
    [...]
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant