include a role condition test for AUD in sample CFN template

aws-actions · Nov 2, 2022 · 85ec61b · 85ec61b
1 parent 3179f23
commit 85ec61b
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -149,6 +149,10 @@ Parameters:
     Description: Arn for the GitHub OIDC Provider.
     Default: ""
     Type: String
+  OIDCAudience:
+    Description: Audience supplied to configure-aws-credentials.
+    Default: "sts.amazonaws.com"
+    Type: String
 
 Conditions:
   CreateOIDCProvider: !Equals 
@@ -169,6 +173,8 @@ Resources:
                 - !Ref GithubOidc
                 - !Ref OIDCProviderArn
             Condition:
+              StringEquals:
+                token.actions.githubusercontent.com:aud: !Ref OIDCAudience
               StringLike:
                 token.actions.githubusercontent.com:sub: !Sub repo:${GitHubOrg}/${RepositoryName}:*