aws-github-oidc-scoped-role
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documentation provides legitimate and security-focused Infrastructure-as-Code (Terraform/OpenTofu) patterns for AWS IAM and GitHub Actions integration.
- [SAFE]: It promotes security best practices by recommending the use of the
job_workflow_refclaim for tight OIDC scoping, which prevents unauthorized workflows within a repository from assuming sensitive roles. - [SAFE]: The provided IAM policy example follows the principle of least privilege by combining
ReadOnlyAccesswith explicitDenystatements for sensitive operations like reading secrets or decrypting data via KMS. - [SAFE]: External references are limited to well-known, official service endpoints (GitHub Actions OIDC and AWS STS).
Audit Metadata