A security community success story of mitigating a misconfiguration

This report describes a widespread misconfiguration in AWS IAM role trust policies for GitHub Actions OIDC integrations where the absence of the 'sub' condition allowed any GitHub repository to assume vulnerable roles, potentially enabling account takeover. Researchers and vendors identified the issue—exacerbated by a Terraform JSON handling quirk and copied tutorials—then coordinated mitigations including Terraform warnings/rules, AWS console UI changes, customer notifications, and eventual enforcement requiring the 'sub' condition.