Merge pull request #118 from prdngr/fix-privesc-false-positive

Fix false positive where GitHub Actions subject was not recognized

Author: jbarciabf

aws/role-trusts.go

@@ -466,6 +466,8 @@ func parseFederatedTrustPolicy(statement policy.RoleTrustStatementEntry) (string
 			subjects = append(subjects, statement.Condition.StringLike.TokenActionsGithubusercontentComSub...)
 		} else if len(statement.Condition.StringEquals.TokenActionsGithubusercontentComSub) > 0 {
 			subjects = append(subjects, statement.Condition.StringEquals.TokenActionsGithubusercontentComSub...)
+		} else if len(statement.Condition.ForAllValuesStringLike.TokenActionsGithubusercontentComSub) > 0 {
+			subjects = append(subjects, statement.Condition.ForAllValuesStringLike.TokenActionsGithubusercontentComSub...)
 		} else {
 			subjects = append(subjects, "ALL REPOS!!!")
 		}

internal/aws/policy/role-trust-policies.go

@@ -64,6 +64,9 @@ type RoleTrustStatementEntry struct {
 			CircleCISub                         ListOfPrincipals `json:"CircleCISub"`
 			// Add patterns for provider-specific claims that support wildcards or partial matches
 		} `json:"StringLike"`
+		ForAllValuesStringLike struct {
+			TokenActionsGithubusercontentComSub ListOfPrincipals `json:"token.actions.githubusercontent.com:sub"`
+		} `json:"ForAllValues:StringLike"`
 		ForAnyValueStringLike struct {
 			CognitoAMR string `json:"cognito-identity.amazonaws.com:amr"`
 			//Auth0Amr   ListOfPrincipals `json:"Auth0Amr"`