oidc-audit

Scan AWS IAM roles for OIDC trust policy misconfigurations in GitHub Actions. Free CLI by TrustFix.

Quick Start

npx oidc-audit scan

What It Detects

| Finding Type | Severity | Description | |-------------|----------|-------------| | MISSING_SUB_CLAIM | CRITICAL | Trust policy allows any GitHub repo to assume the role | | WILDCARD_SUB_CLAIM | CRITICAL | Overly permissive wildcard in sub claim (*, repo:*) | | MISSING_AUD_CLAIM | HIGH | Missing audience claim validation | | ORG_WIDE_TRUST | HIGH | Allows any repository in an organization | | PULL_REQUEST_ALLOWED | HIGH | Allows pull_request events (external contributors) | | FORKED_REPO_ALLOWED | HIGH | May allow forked repositories | | REF_TYPE_MISSING | MEDIUM | No branch/tag restriction | | ENVIRONMENT_NOT_REQUIRED | MEDIUM | No GitHub environment requirement | | WORKFLOW_NOT_PINNED | MEDIUM | Not pinned to specific workflow file | | ACTOR_NOT_RESTRICTED | LOW | No actor/user restriction |

Usage

# Scan with default AWS credentials
npx oidc-audit scan

# Use a specific AWS profile
npx oidc-audit scan --profile production

# Cross-account scan with assumed role
npx oidc-audit scan --role-arn arn:aws:iam::123456789012:role/AuditRole

# JSON output for CI/CD
npx oidc-audit scan --json

# Filter by minimum severity
npx oidc-audit scan --severity HIGH

Options

| Flag | Description | Default | |------|-------------|---------| | --profile <name> | AWS profile to use | default | | --region <region> | AWS region | us-east-1 | | --role-arn <arn> | IAM role ARN for cross-account scanning | - | | --json | Output as JSON | false | | --severity <level> | Minimum severity (CRITICAL, HIGH, MEDIUM, LOW) | LOW |

Required IAM Permissions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles",
        "iam:GetRole"
      ],
      "Resource": "*"
    }
  ]
}

CI/CD Integration

GitHub Actions

name: OIDC Audit
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/AuditRole
          aws-region: us-east-1

      - name: Run OIDC audit
        run: npx oidc-audit scan --severity HIGH

Example Output

🔍 TrustFix OIDC Audit Scanner

Scanning account: 123456789012
Found 47 IAM roles, analyzing trust policies...

Summary:
  Critical: 2  High: 5  Medium: 8  Low: 3

┌──────────┬────────────────────────────┬──────────────────────────────┬──────────────────────────────────────────────────┐
│ Severity │ Finding Type               │ Role                         │ Description                                      │
├──────────┼────────────────────────────┼──────────────────────────────┼──────────────────────────────────────────────────┤
│ CRITICAL │ MISSING_SUB_CLAIM          │ github-actions-deploy        │ OIDC trust policy allows any GitHub repository  │
│          │                            │                              │ to assume this role                              │
├──────────┼────────────────────────────┼──────────────────────────────┼──────────────────────────────────────────────────┤
│ HIGH     │ ORG_WIDE_TRUST             │ ci-cd-role                   │ OIDC trust policy allows any repository in the  │
│          │                            │                              │ organization                                     │
└──────────┴────────────────────────────┴──────────────────────────────┴──────────────────────────────────────────────────┘

❌ Critical or high severity issues found. Review and remediate before merging.

Why This Matters

OIDC trust policies are a powerful way to grant GitHub Actions access to AWS without long-lived credentials. But misconfigured trust policies can allow unauthorized repositories — even forks or external contributors — to assume your IAM roles.

TrustFix scans your AWS account and identifies trust policies that are:

• Too permissive (missing sub claim, wildcards)
• Missing critical conditions (audience, branch restrictions)
• Vulnerable to supply chain attacks (pull_request events, forked repos)

Get More with TrustFix Pro

The CLI detects issues. TrustFix Pro fixes them:

• AI-generated Terraform fix PRs — Claude writes the fix, validates it
• Policy Intelligence Engine — 45+ deterministic assertions
• Confidence scores — Know how safe each fix is before merging
• Blast-radius analysis — See what the fix affects

Start free at trustfix.dev

License

MIT — see LICENSE