GitHub Actions: A Cloudy Day for Security
summary
Covers concrete failures and fixes for GitHub Actions plus cloud federation: shows script injection via workflow contexts and the safe fix using env, demonstrates collaborators modifying workflows to bypass branch protections and read repository secrets, proves an exfiltrated Azure token via an OIDC Azure login action, and shows terraform plan executing during a reusable workflow to leak credentials. Explains OIDC subject formats, warns against wildcards, recommends tying subjects to protected branches/environments, asserting specific claims, and using job_workflow_ref to restrict reusable workflows.
AI-written summary · about
chapters (10)
- 0:00GitHub Actions security intro
- 8:33Script injection in workflows
- 14:16Collaborator permissions exploit
- 18:48Stealing secrets via workflows
- 24:07Cloud security with OIDC
- 31:31OIDC config AWS/Azure/GCP
- 37:13OIDC subject claims pitfalls
- 44:18Isolating critical workflows
- 51:22Reusable workflows risks
- 53:48GitHub Actions security summary
related talks
56mHow to use GitHub Actions with Security in mind
42mProtecting CI/CD from malicious deploys
45mGitHub Actions & Security
15mGitHub Actions: a time bomb for supply chain security
51mHow to secure your GitHub Actions
43mGitHub Actions Best Practices
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
44mAttacking & Defending Supply Chains. How we got Admin in your Cloud,...