When configuring AWS to trust GitHub Actions OIDC tokens, the 'sub' claim can filter which workflows can assume the role. Which is an example of a valid sub claim for a specific branch?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The OIDC sub claim follows a specific format: repo:{owner}/{repo}:{filter}:{value} — use it in IAM trust policies to restrict which workflows can assume the role.
Full explanation below image
Full Explanation
GitHub's OIDC JWT 'sub' (subject) claim identifies the workflow context. The format is 'repo:{owner}/{repo}:{qualifier}:{value}'. For a specific branch: 'repo:owner/repo:ref:refs/heads/main'. For a specific environment: 'repo:owner/repo:environment:production'. For pull requests: 'repo:owner/repo:pull_request'. Wildcards can be used in AWS IAM condition values. This sub claim is used in AWS IAM trust policy conditions to restrict which GitHub repositories, branches, or environments can assume an IAM role, providing fine-grained control over cloud access.