Hulumi Policies GitHub OIDC Trust Policy Validation Bypass

Technical Analysis

The vulnerability stems from insufficient validation logic in @hulumi/policies' policy-linting engine, which fails to recognize that set-qualified condition operators like ForAnyValue:StringLike can effectively implement wildcard matching against the GitHub OIDC 'sub' claim, bypassing checks intended to flag broad trust conditions (e.g., simple StringLike with wildcards). An attacker with write access to a CI/CD configuration or a compromised upstream dependency could inject a crafted trust policy that appears restrictive to automated guardrails but actually grants any workflow in an organization (or even any public repo under specific conditions) the ability to assume a privileged IAM role via OIDC federation. This is a logic/validation bypass (CWE-697/CWE-284 class) rather than a memory-safety issue, with CVSS 9.8 reflecting the potential for full account takeover via CI/CD pipeline abuse. Organizations using Infrastructure-as-Code (IaC) policy validation from this package in their deployment pipelines for AWS resources are directly exposed. For AI agent systems, this is highly relevant: agentic CI/CD pipelines, autonomous DevOps agents, and MLOps platforms that provision cloud infrastructure via GitHub Actions OIDC federation could have their IAM trust boundaries silently widened, allowing attackers to hijack agent-deployed cloud resources, exfiltrate API keys/secrets used by agents, or pivot into AI infrastructure with elevated AWS permissions.

Affected Systems

@hulumi/policies npm package versions prior to 1.3.2; AWS IAM trust policies configured for GitHub Actions OIDC federation; CI/CD pipelines and IaC deployments (Pulumi-based) that rely on this package for policy validation/linting

Indicators of Compromise

• N/A - this is a logic vulnerability in a policy validation library; no known malicious hashes, IPs, or domains associated. Indicators of exploitation would include: unexpected IAM trust policy conditions using ForAnyValue:StringLike operators, unrecognized GitHub repository/workflow subjects assuming AWS roles, anomalous AssumeRoleWithWebIdentity CloudTrail events from unfamiliar repos

Remediation Steps

1. 1

   Upgrade @hulumi/policies

   Update to version 1.3.2 or later immediately across all Pulumi/IaC pipelines that use this package for policy validation.

2. 2

   Audit existing IAM trust policies

   Manually review all AWS IAM roles with GitHub OIDC trust relationships for use of set-qualified operators (ForAnyValue:StringLike, ForAllValues:StringLike) and validate the actual scope of matched subjects.

3. 3

   Enforce explicit subject conditions

   Replace wildcard or set-operator-based conditions with explicit, fully-qualified repo:ref or repo:environment subject strings in OIDC trust policies.

4. 4

   Enable CloudTrail monitoring

   Set up alerts for AssumeRoleWithWebIdentity calls from unexpected GitHub Actions subjects or unfamiliar repositories.

5. 5

   Review CI/CD and agent pipeline permissions

   For AI agent or MLOps pipelines using OIDC-federated AWS access, apply least-privilege scoping and re-validate trust boundaries after patching.