Clarification in trust-relationship policy example

[conradt-paf]

I've tested a wide variety of cases and compared to Cloudtrail Events.

only sub is currently sent to and compared in AWS open-id connector for GitHub.
aud will always be sts.amazonaws.com, making the aud string used in the example obsolete (and possibly misleading)

So, the IAM trust relationship policy (GitHub OIDC -> AWS) for the role-to-be-assumed should perform conditional checks on sub which (currently only) contain this information:

"token.actions.githubusercontent.com:sub": "repo:organization-name/repository-name:ref:refs/heads/branch-name"

If the conditional StringLike is used, wildcard can be used for branch-name

There might be other things to touch up on in this README.md to reflect this information

Why:

fix some confusion

What's being changed:

IAM policy example will correctly check for aud and sub claim that AWS openid-connector uses.
sub claim inherently contains organization claim already.

We also use ForAllValues to correctly perform an AND operation (instead of OR)

Check off the following:

• I have reviewed my changes in staging (look for "Automatically generated comment" and click Modified to view your latest changes).
• For content changes, I have completed the self-review checklist.

Writer impact (This section is for GitHub staff members only):

• This pull request impacts the contribution experience
  • I have added the 'writer impact' label
  • I have added a description and/or a video demo of the changes below (e.g. a "before and after video")

[welcome]

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[github-actions]

Automatically generated comment ℹ️

This comment is automatically generated and will be overwritten every time changes are committed to this branch.

The table contains an overview of files in the content directory that have been changed in this pull request. It's provided to make it easy to review your changes on the staging site. Please note that changes to the data directory will not show up in this table.

---

Content directory changes

You may find it useful to copy this table into the pull request summary. There you can edit it to share links to important articles or changes and to give a high-level overview of how the changes in your pull request support the overall goals of the pull request.

Source	Staging	Production	What Changed
content/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services.md	Modified	Original

[ramyaparimi]

@conradt-paf
Thanks so much for opening a PR! I'll get this triaged for review ⚡

[conradt-paf]

"Condition": {
  "ForAllValues:StringEquals": {
    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
    "token.actions.githubusercontent.com:sub": "repo:octo-org/octo-repo:ref:refs/heads/octo-branch"
  }
}

"Condition": {
  "StringEquals": {
    "token.actions.githubusercontent.com:sub": "repo:octo-org/octo-repo:ref:refs/heads/octo-branch"
  }
}

Using StringLike

"Condition": {
  "StringLike": {
    "token.actions.githubusercontent.com:sub": "repo:octo-org/octo-repo:ref:refs/heads/*"
  }
}

[conradt-paf]

Tested and working, that was the final commit. You may push to this fork/branch if possible

[conradt-paf]

@conradt-paf Thanks so much for opening a PR! I'll get this triaged for review ⚡

Thank you, I added even more clarification after rigorous testing and trying to find out how this works

[martin389]

Status update: I've asked for tech review of these proposed changes 👍

[martin389]

Update: just doing some final checks

[martin389]

Status update: confirming tech review

[martin389]

PM has approved this change 👍

[martin389]

Looks good in staging: https://docs-preview-12137-db0886.eastus.azurecontainer.io/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#configuring-the-role-and-trust-policy

[github-actions]

Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues ⚡