TIL how to limit authorization via OIDC condition context keys in AWS IAM trust policies
When assuming AWS IAM roles from a GitLab CI/CD job using OIDC, it is possible limit authorization to a specific group, project, branch or tag using additional condition context keys in the role's trust policy.
Note:
This assumes you have setup GitLab as an IAM OIDC identity provider in AWS.
On GitLab.com, AWS supports many different condition
keys
that can be used to restrict the role to jobs in specific pipeline sources and
environments. However, on a self-managed GitLab instance (which I use), AWS only
supports sub, which can only limit the group, project and branch name.
For example, on a self-managed GitLab instance, the following condition supports CI/CD jobs in all branches, including merge request pipelines.
"Condition": {
"StringEquals": {
"<hostname>:aud": "https://<hostname>"
},
"StringLike": {
"<hostname>:sub": "project_path:<group>/<project>:ref_type:branch:ref:*"
}
}