How to use GitHub immutable values (IDs) in Attribute Conditions?

Question

Configuring auth to Google Cloud from GitHub Actions includes security considerations that make the seemingly sensible recommendation to bind using GitHub's immutable|unique IDs (owner|repo) rather than names.

Even though Google recommends IDs, its documentation refers to names:

gcloud iam workload-identity-pools providers create-oidc "my-repo" \
--project="${PROJECT_ID}" \
--location="global" \
--workload-identity-pool="github" \
--display-name="My GitHub repo Provider" \
--attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
--attribute-condition="assertion.repository_owner == '${OWNER}'" \
--issuer-uri="https://token.actions.githubusercontent.com"

I understand how to revise the --attribute-condition to use the IDs but, how do I change the --attribute-mapping to incorporate them?

Naively revising --attribute-mapping values to e.g. attribute.repository_id=assertion.repository_id to match --attribute-condition values assertion.repository_owner_id=="{OWNER_ID}" doesn't work.

I know that the ID claims are included thanks to the GitHub OIDC Debugger:

{
  ...
  "repository": "{OWNER}/{REPO}",
  "repository_id": "{REPO_ID}",
  "repository_owner": "{OWNER}",
  "repository_owner_id": "{OWNER_ID}",
  ...
}

Looks like you need GITHUB_REPOSITORY_OWNER and GITHUB_REPOSITORY_OWNER_ID env vars for assertion.repository_owner and assertion.repository_owner_id. See the default envrironment variables for the complete list. — Azeem
– Azeem, Commented Sep 21, 2024 at 5:38

DazWilkin · Accepted Answer · 2024-09-21 15:42:40Z

The solution appears to be:

Leaving the --attribute-mapping either unchanged (must contain repository and repository_owner) or adding (repository_id and repository_owner_id)
Using the IDs in --attribute-condition (per the security considerations) and optionally/redundantly (!?) including/retaining the name predicates.

Minimally:

gcloud iam workload-identity-pools providers create-oidc "my-repo" \
--project="${PROJECT_ID}" \
--location="global" \
--workload-identity-pool="github" \
--display-name="My GitHub repo Provider" \
--attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner" \
--attribute-condition="assertion.repository_owner_id == '${OWNER_ID}' && assertion.repository_id == '${REPO_ID}'" \
--issuer-uri="https://token.actions.githubusercontent.com"

Delta George · Accepted Answer · 2024-09-21 09:52:32Z

0

In addition to Azeem’s comment, you also need to make sure that single quotes are preserved. I believe you had them in the original code block.

edited Sep 21, 2024 at 9:52

answered Sep 21, 2024 at 9:47

Delta George

4,3723 gold badges20 silver badges14 bronze badges

1 Comment

DazWilkin Over a year ago

Thanks for the suggestion. The CEL appears to accept double- (") or single-quotes (') without issue.

Collectives™ on Stack Overflow

How to use GitHub immutable values (IDs) in Attribute Conditions?

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related