Check Our Work

Every answer CloudArq shows you is the engine's, and the engine is source available. Run it on your own machine, on the file you uploaded, and it gives you the same answers.

True for: cloudarq 0.3.0 and cloudarq-collect 0.3.0
Contact: [email protected]

What an upload sends

The engine's answers for your roles, not your file. The page reads the file in your browser, and the file stays on your computer.

When you drop estate.json on Connect, the engine in the page reads it there and marks the owners you declared as yours, and the page sends us its findings, with (removed) written in AWS's messages in place of the names that the row for message lists. These tables list every field we receive.

What we receive for the account
Field	Holds
format	Always cloudarq.findings/v1.
provider	Always aws.
account	The account's 12-digit ID.
alias	The account's alias, when the collector read one.
organization	The AWS Organization the account is in, as the collector read it and a table below lists, when the engine says.
recognised	The owners the engine counts as yours without your declaring them: the account it read, with why.
suggested	The owners the engine asks you about, such as the account that manages your Organization, each with its question.
collected_at	When the collector read the account.
collector	The collector's name and version.
engine	The engine that answered, such as cloudarq 0.3.0.
bundle_sha256	The SHA-256 of your file's bytes.
roles	One entry for each role, as the next table lists.
refused	Each call of the collector AWS refused or never answered, or answered without what was asked, as the table after it lists.
limits	Each limit the collector noted, in its words.

What we receive for each role
Field	Holds
arn	The role's ARN, which holds its path and name.
name	The role's name.
path	The role's path, which its ARN holds too, when your file names it.
managed	For a role AWS made for one of its services and manages, the engine's words for it, as a table below lists.
document_sha256	The SHA-256 of the role's trust policy, as your file holds it.
answer	The engine's answer for the role, with the version of its form: the one sentence it opens on; who can get in, grant by grant, with the parts of the policy each grant rests on, such as its statement IDs, the issuers it trusts and the values its conditions match; the rings, which place each grant by how far from you it reaches; the sign-ins and cloud services no ring can place; the grants that deny, and those that admit no one; the owners you declared, as the engine read them, with any line it refused and any that no grant is pinned to, and those it counts as yours without your declaring them, with why; and what was not read that could narrow the answer. Of the policy itself it holds its size in bytes and lines, its version, its SHA-256 and the engine's notes on how it is written, and for each statement its number, its ID, its byte offset and length, its first and last line, and its SHA-256. It is not the policy's text. For a policy it could not read, it holds why.
would_move	For each owner the engine asks you about, what the role's answer would open on were you to declare it, as a table below lists.

What we receive of the account's AWS Organization
Field	Holds
status	member; not-a-member; refused, when the collector's call that reads it is among the refused or unanswered calls; or not-read.
id	For a member, the Organization's ID.
management_account	For a member, the 12-digit ID of the account that manages the Organization.
feature_set	For a member, the Organization's feature set, such as ALL.

What we receive for each owner the engine counts as yours
Field	Holds
declaration	The owner, as you would declare it, such as aws:123456789012.
sentence	Why the engine counts it as yours, in its words.

What we receive for each owner the engine asks about
Field	Holds
declaration	The owner, as you would declare it.
question	The engine's question about it.
declared	Whether the owners you declared already answer it.

What we receive of a role AWS made
Field	Holds
by	Who made it: aws.
service	The service AWS made it for, such as organizations.amazonaws.com.
sentence	The engine's sentence for what the role is.
caption	The engine's sentence for why who gets in through it is not known.

What we receive for each owner that would move a role's answer
Field	Holds
declaration	The owner, as you would declare it.
question	The engine's question about it.
sentence	The sentence the role's answer would then open on.
spans	That sentence in parts, as a table below lists.

What we receive for each part of a sentence
Field	Holds
text	The part's words.
mark	How the part is drawn, such as code or exact, when it is drawn apart.
note	The number of the engine's note the part refers to, when it refers to one.

What we receive for each refused or unanswered call
Field	Holds
call	The call, such as iam:ListAccountAliases.
code	AWS's error code, or Unanswered when the call never reached AWS or AWS answered without what was asked.
message	AWS's message, or the reason the call went unanswered. AWS names the identity that made the call by its ARN, and for a role, the session name, which can be a person's sign-in. Before the page sends the message, it writes (removed) in place of a role's session name, a user's path and name, a federated user's name, and an MFA device's or U2F key's name, and we do the same to any message that reaches us with one. The account, the role's name, the call and the missing permission stay as AWS wrote them, and the reason a call went unanswered stays as the collector wrote it.

What the upload adds
Field	Holds
sha256	A SHA-256 of the findings themselves, so the same upload sent twice is kept once.

What stays on your computer is the file itself: each role's trust policy as written, its ID, creation date, description and maximum session duration, and the ARNs of the AWS Organization the account is in and of its management account. Your AWS credentials never reach the page; the collector used them on your machine. We never receive the file, so the one to check is the one you kept.

Match your file

Its SHA-256 is the fingerprint the Overview shows for the scan read from it.

Print your file's SHA-256

shasum -a 256 estate.json

Each cloud account's card on the Overview shows the fingerprint of the file its latest scan was read from: the SHA-256 the engine recorded when the page read it. If the two match, the file you kept is the one we hold the answers for. On Linux without shasum, sha256sum estate.json prints the same.

Install the engine

One go install, with Go 1.24.13 or later.

Install the command line

go install github.com/CloudArq-net/cloudarq/cmd/[email protected]

go install builds it with your Go when it is 1.24.13 or later. With an older Go, the go command first fetches a newer one, unless GOTOOLCHAIN says otherwise. Its source is on GitHub. v0.1 to v0.3.0 are under the Apache License 2.0. Releases after v0.3.0 are under the Functional Source License 1.1, and each becomes Apache 2.0 two years after it ships.

go install puts cloudarq in $(go env GOPATH)/bin, or in GOBIN when that is set. If GOBIN is not set and your shell does not find cloudarq, this line adds that directory to your PATH.

Put it on your PATH

export PATH="$PATH:$(go env GOPATH)/bin"

cloudarq version then prints cloudarq 0.3.0.

The engine in the page is the same release, built for your browser with TinyGo. It also holds parts of Go's standard library, TinyGo's runtime, LLVM's compiler-rt and wasi-libc, with musl and cloudlibc, and tables made from Unicode's data. Each one's licence is in the engine's notices.

Rerun the answers

Give the command the file you uploaded and the owners you had declared, and each role's answer is the one the console shows.

Answer every role in the file

cloudarq admits --bundle estate.json

Add one --owner for each owner the account's card on the Overview says its scan was read with. For an AWS account it is aws: followed by the account number, such as aws:111122223333 for AWS account 111122223333; for an AWS Organization, aws: followed by its ID, such as aws:o-a1b2c3d4e5 for AWS Organization o-a1b2c3d4e5; for a GitHub organisation, github: followed by its name, such as github:acme for the GitHub organisation acme. Nerd mode shows each owner's form on the card, in brackets, as --owner takes it. Add none if it was read with none. Where the engine read no role of the file, the card names no owners: add those listed under Your company's accounts and sign-ins in Settings when you uploaded it, written as Settings writes them, such as github:acme or aws:111122223333. Leave out any line Settings kept that the engine refused: the command stops on it, with exit code 2.

With --json, it prints the findings in the form the page sent us. For the same file and owners, the engine in the page and this command write the same findings. Each writes (removed) in AWS's message for each refused call in place of a role's session name, a user's path and name, a federated user's name, and an MFA device's or U2F key's name; the role's name, and the reason a call went unanswered, stay as they were. The page checks each message for those names again before it shows or sends it.

The findings, as sent

cloudarq admits --bundle estate.json --json

What it prints

For each role, its name and ARN, the sentence the console shows for it, and then who can get in, grant by grant.

Below is what cloudarq admits --bundle estate.json prints on standard output for an example bundle: eight roles of the account 123456789012, invented as examples and standing for no one's. On standard error it also names the call the collector was refused when that bundle was made, iam:ListAccountAliases. In a terminal it marks the output in colour, unless --no-color is given or NO_COLOR is set.

cloudarq admits --bundle estate.json, on the example

"06-unconstrained"  "arn:aws:iam::123456789012:role/06-unconstrained"

read as an aws trust policy · version 2012-10-17 · 441 bytes · 18 lines · 1 statement
sha256 45a919f7a7aff68d1536ef05a469f721a8b209527c9f7c24720959eeab4c4a76

Anyone on GitHub can assume this role.

  Anyone            exact           No grant is placed with people who have no account anywhere.
  Anyone on GitHub  exact  grant 1  Anyone on GitHub can assume this role; no condition confines its tokens to one owner.
  A named outsider  exact           No grant is placed with a named outsider.
  Your pipelines    exact           No grant is confined to owners declared as yours.
  Your people       exact           No grant trusts a SAML provider declared as yours.

Each of these can narrow the rings and was not read: the organisation's resource control policies, the calling accounts' service control policies and this account's identity providers.

grant 1 of 1 · statement[0] "GitHubUnconstrained" · Allow · https://token.actions.githubusercontent.com · platform · exact
This role admits every identity token.actions.githubusercontent.com issues a token to, whoever holds it: the only claim named is aud, and an audience is not a boundary.
Exact means the set is known exactly, not that it is small: no construct went unevaluated.

CLAIM            ADMITS               IN WORDS · AS WRITTEN
aud              "sts.amazonaws.com"  exactly this audience · line 13 StringEquals
sub              any                  any subject · no condition names it
any other claim  any                  unconstrained · no condition names it

a token this grant admits
  {
    "iss": "https://token.actions.githubusercontent.com",
    "aud": "sts.amazonaws.com"
  }
The decoded payload. A claim not shown is unconstrained by this grant, but for azp, and none of the claims shown names an identity: whoever holds a token like this is admitted. It sets no azp: AWS reads aud from azp whenever a token sets one.

statement[0] "GitHubUnconstrained" · offset 50 · 384 bytes · lines 4-16 · issuer at line 8 Principal.Federated · sha256 8f2161ff1dc8a8d486dcfc196b38ba57bcba5aa4f979869901e1cef3cf505ee3

"11-principal-shapes"  "arn:aws:iam::123456789012:role/11-principal-shapes"

read as an aws trust policy · version 2012-10-17 · 1913 bytes · 80 lines · 8 statements
sha256 0356e3efe029a94323dab8d1407decac9f7cdabe9112239737107748ad1a9424

Anyone could assume this role; so can cloud services.

  Anyone                 unknown  grant 9          Anyone could assume this role: it trusts a principal whose kind is not read.
  Anyone on 2 platforms  exact    grants 7, 8, 10  Anyone on AWS can assume this role; anyone on Google could.
  A named outsider       exact    grants 6, 11     aws:999999999999 and github:acme can assume this role and are not declared as yours.
  Your AWS accounts      exact    grant 5          aws:123456789012, recognised: the account this scan read, can assume this role.
  Your people            exact                     No grant trusts a SAML provider declared as yours.
  ──
  Cloud services         unknown  grants 1, 2, 4   Any cloud service can assume this role; which ones, and for whom, is not read.

Grant 3 refuses, so it is in no ring; the rings do not subtract it.
Each of these can narrow the rings and was not read: the organisation's resource control policies, the calling accounts' service control policies and this account's identity providers.

grant 1 of 11 · statement[0] "BareStar" · Allow · service · unknown
Who this statement admits is not known: the statement applies to every principal, and which AWS services it covers through sts:AssumeRole is not known.
The set shown is an upper bound, not the set: a token not excluded here may still be refused by AWS.

CLAIM            ADMITS  IN WORDS · AS WRITTEN
any other claim  any     unconstrained · no condition names it

notes
  1  the statement applies to every principal, and which AWS services it covers through sts:AssumeRole is not known
     caveat · statement[0].Principal
  2  the statement applies to every principal, including anonymous ones
     anomaly · any-principal · Principal · statement[0].Principal
  3  same as note 1
     anomaly · unmodelled-construct · Principal · statement[0].Principal

statement[0] "BareStar" · offset 50 · 114 bytes · lines 4-9 · issuer at line 7 Principal · sha256 893b87d963f87177d098915a7110ddec384055bcc773b8668cc8f1f317d6da0a

grant 2 of 11 · statement[1] "AWSStar" · Allow · service · unknown
Who this statement admits is not known: the statement applies to every principal, and which AWS services it covers through sts:AssumeRole is not known.
The set shown is an upper bound, not the set: a token not excluded here may still be refused by AWS.

CLAIM            ADMITS  IN WORDS · AS WRITTEN
any other claim  any     unconstrained · no condition names it

notes
  1  the statement applies to every principal, and which AWS services it covers through sts:AssumeRole is not known
     caveat · statement[1].Principal
  2  the statement applies to every principal, including anonymous ones
     anomaly · any-principal · Principal · statement[1].Principal
  3  same as note 1
     anomaly · unmodelled-construct · Principal · statement[1].Principal

statement[1] "AWSStar" · offset 170 · 138 bytes · lines 10-17 · issuer at line 13 Principal · sha256 579bb04d13e5a338797bd16a2bde4f696655bb76c49654c16457b93c99b27e24

grant 3 of 11 · statement[7] "NotPrincipalIsADifferentThing" · Deny · refused
This statement admits nobody through this principal: this Deny statement could not be fully evaluated, so it is not applied; the admitted set is an upper bound.

notes
  1  this Deny statement could not be fully evaluated, so it is not applied; the admitted set is an upper bound
     caveat · statement[7]
  2  NotPrincipal is not supported in a role trust policy and names who is excluded rather than who is admitted, so who the statement admits is not known
     caveat · statement[7].Principal
  3  same as note 2
     anomaly · unmodelled-construct · NotPrincipal · statement[7].Principal
  4  same as note 1
     anomaly · unmodelled-construct · Deny · statement[7]

statement[7] "NotPrincipalIsADifferentThing" · offset 1712 · 194 bytes · lines 71-78 · sha256 b3ac1f6fb3fcf4038e51e6fa88a833178c23960f587bb418e9caf60a75b024d8

grant 4 of 11 · statement[5] "ServicePrincipal" · Allow · aws:service:ec2.amazonaws.com · service · unknown
This role admits ec2.amazonaws.com, acting for whoever can make it act: no condition constrains this statement.
Who can make the service act, or receives its session, is not read: who gets in through it is not known.

CLAIM            ADMITS  IN WORDS · AS WRITTEN
sub              any     any subject · no condition names it
any other claim  any     unconstrained · no condition names it

notes
  1  ec2.amazonaws.com is an AWS service principal; who can make it act, or receives its session, is not read
     anomaly · service-principal · Service · statement[5].Principal

a token this grant admits
  {}
The decoded payload. A claim not shown is unconstrained by this grant, and none of the claims shown names an identity: whoever holds a token like this is admitted.

statement[5] "ServicePrincipal" · offset 1316 · 167 bytes · lines 55-62 · issuer at line 58 Principal · sha256 43a87d335305b5806e3729a9c178c907e8b2e55d4bc8516409b7de496d9f49cd

grant 5 of 11 · statement[2] "RoleArnAndBareAccountId" · Allow · aws:sts · yours · exact
This role admits any AWS principal whose aws:principalaccount is 123456789012 and whose aws:principalarn is arn:aws:iam::123456789012:role/ci.
Who holds those identities now is not computed here: no network request is made.

CLAIM                 ADMITS                               IN WORDS · AS WRITTEN
aws:principalaccount  "123456789012"                       exactly this value · from Principal
aws:principalarn      "arn:aws:iam::123456789012:role/ci"  exactly this value · from Principal
any other claim       any                                  unconstrained · no condition names it

a token this grant admits
  {
    "aws:principalaccount": "123456789012",
    "aws:principalarn": "arn:aws:iam::123456789012:role/ci"
  }
The decoded payload. A claim not shown is unconstrained by this grant.

statement[2] "RoleArnAndBareAccountId" · offset 314 · 234 bytes · lines 18-28 · issuer at line 21 Principal · sha256 87d2526847039e6f0baf4b91cb09ea0f3fa78e3c4571174c6d510bdc513a8f29

grant 6 of 11 · statement[2] "RoleArnAndBareAccountId" · Allow · aws:sts · outsider · exact
This role admits any AWS principal whose aws:principalaccount is 999999999999.
Who holds those identities now is not computed here: no network request is made.

CLAIM                 ADMITS          IN WORDS · AS WRITTEN
aws:principalaccount  "999999999999"  exactly this value · from Principal
any other claim       any             unconstrained · no condition names it

a token this grant admits
  {
    "aws:principalaccount": "999999999999"
  }
The decoded payload. A claim not shown is unconstrained by this grant.

statement[2] "RoleArnAndBareAccountId" · offset 314 · 234 bytes · lines 18-28 · issuer at line 21 Principal · sha256 87d2526847039e6f0baf4b91cb09ea0f3fa78e3c4571174c6d510bdc513a8f29

grant 7 of 11 · statement[0] "BareStar" · Allow · aws:sts · platform · exact
This role admits every AWS principal, in any account: no condition constrains this statement.
Exact means the set is known exactly, not that it is small: no construct went unevaluated.

CLAIM            ADMITS  IN WORDS · AS WRITTEN
sub              any     any subject · no condition names it
any other claim  any     unconstrained · no condition names it

notes
  1  the statement applies to every principal, including anonymous ones
     anomaly · any-principal · Principal · statement[0].Principal

a token this grant admits
  {}
The decoded payload. A claim not shown is unconstrained by this grant, and none of the claims shown names an identity: whoever holds a token like this is admitted.

statement[0] "BareStar" · offset 50 · 114 bytes · lines 4-9 · issuer at line 7 Principal · sha256 893b87d963f87177d098915a7110ddec384055bcc773b8668cc8f1f317d6da0a

grant 8 of 11 · statement[1] "AWSStar" · Allow · aws:sts · platform · exact
This role admits every AWS principal, in any account: no condition constrains this statement.
Exact means the set is known exactly, not that it is small: no construct went unevaluated.

CLAIM            ADMITS  IN WORDS · AS WRITTEN
sub              any     any subject · no condition names it
any other claim  any     unconstrained · no condition names it

notes
  1  the statement applies to every principal, including anonymous ones
     anomaly · any-principal · Principal · statement[1].Principal

a token this grant admits
  {}
The decoded payload. A claim not shown is unconstrained by this grant, and none of the claims shown names an identity: whoever holds a token like this is admitted.

statement[1] "AWSStar" · offset 170 · 138 bytes · lines 10-17 · issuer at line 13 Principal · sha256 579bb04d13e5a338797bd16a2bde4f696655bb76c49654c16457b93c99b27e24

grant 9 of 11 · statement[6] "CanonicalUser" · Allow · aws:sts · anyone · unknown
Who this statement admits is not known: a CanonicalUser principal is not modelled by this parser, so who it names is not known.
The set shown is an upper bound, not the set: a token not excluded here may still be refused by AWS.

CLAIM            ADMITS  IN WORDS · AS WRITTEN
any other claim  any     unconstrained · no condition names it

notes
  1  a CanonicalUser principal is not modelled by this parser, so who it names is not known
     caveat · statement[6].Principal
  2  same as note 1
     anomaly · unmodelled-construct · CanonicalUser · statement[6].Principal

statement[6] "CanonicalUser" · offset 1489 · 217 bytes · lines 63-70 · issuer at line 66 Principal · sha256 b9f10953c73ae705c991022e964bdf67cb430343693f0efcc5d2c2302432f3ac

grant 10 of 11 · statement[4] "FederatedBuiltInProvider" · Allow · https://accounts.google.com · platform · unknown
This role admits every identity accounts.google.com issues a token to, whoever holds it: the only claim named is aud, and an audience is not a boundary.
Exact means the set is known exactly, not that it is small: no construct went unevaluated.

CLAIM            ADMITS                                            IN WORDS · AS WRITTEN
aud              "123456789012-abcdef.apps.googleusercontent.com"  exactly this audience · line 51 StringEquals
sub              any                                               any subject · no condition names it
any other claim  any                                               unconstrained · no condition names it

a token this grant admits
  {
    "iss": "https://accounts.google.com",
    "aud": "123456789012-abcdef.apps.googleusercontent.com"
  }
The decoded payload. A claim not shown is unconstrained by this grant, but for azp, and none of the claims shown names an identity: whoever holds a token like this is admitted. It sets no azp: AWS reads aud from azp whenever a token sets one.

statement[4] "FederatedBuiltInProvider" · offset 964 · 346 bytes · lines 42-54 · issuer at line 46 Principal.Federated · sha256 94f5aa319ecebb5dfd287e15df6c24535de929ad9aa6ecf398c32fa070b3f40c

grant 11 of 11 · statement[3] "FederatedOIDCProvider" · Allow · https://token.actions.githubusercontent.com · outsider · exact
This role admits any token from token.actions.githubusercontent.com whose sub is repo:acme/infra:ref:refs/heads/main.
Who holds those identities now is not computed here: no network request is made.

CLAIM            ADMITS                                 IN WORDS · AS WRITTEN
sub              "repo:acme/infra:ref:refs/heads/main"  exactly this subject · line 38 StringEquals
any other claim  any                                    unconstrained · no condition names it

a token this grant admits
  {
    "iss": "https://token.actions.githubusercontent.com",
    "sub": "repo:acme/infra:ref:refs/heads/main"
  }
The decoded payload. A claim not shown is unconstrained by this grant.

statement[3] "FederatedOIDCProvider" · offset 554 · 404 bytes · lines 29-41 · issuer at line 33 Principal.Federated · sha256 8e480595ab23c491e873a434951ac7ee1b2283f6dde6fd5721951747a4dd15c5

"anyone-on-github"  "arn:aws:iam::123456789012:role/anyone-on-github"

read as an aws trust policy · version 2012-10-17 · 502 bytes · 20 lines · 1 statement
sha256 c802efe830ab76b84ed416161619529457566d88a64951fd7c6de6af0d4d623f

Anyone on GitHub can assume this role.

  Anyone            exact           No grant is placed with people who have no account anywhere.
  Anyone on GitHub  exact  grant 1  Anyone on GitHub can assume this role; no condition confines its tokens to one owner.
  A named outsider  exact           No grant is placed with a named outsider.
  Your pipelines    exact           No grant is confined to owners declared as yours.
  Your people       exact           No grant trusts a SAML provider declared as yours.

Each of these can narrow the rings and was not read: the organisation's resource control policies, the calling accounts' service control policies and this account's identity providers.

grant 1 of 1 · statement[0] · Allow · https://token.actions.githubusercontent.com · platform · exact
This role admits any token from token.actions.githubusercontent.com whose aud is sts.amazonaws.com and whose sub matches repo:*.
Who holds those identities now is not computed here: no network request is made.

CLAIM            ADMITS               IN WORDS · AS WRITTEN
aud              "sts.amazonaws.com"  exactly this audience · line 12 StringEquals
sub              like:"repo:*"        any subject beginning repo: · line 15 StringLike
any other claim  any                  unconstrained · no condition names it

a token this grant admits
  {
    "iss": "https://token.actions.githubusercontent.com",
    "aud": "sts.amazonaws.com",
    "sub": "repo:"
  }
The decoded payload. A claim not shown is unconstrained by this grant, but for azp. It sets no azp: AWS reads aud from azp whenever a token sets one.

statement[0] · offset 50 · 445 bytes · lines 4-18 · issuer at line 7 Principal.Federated · sha256 eafc4fef4e4b5b8cfbbcf0b05ff67b30573fb007ffbc11f8539717bcf29ed42a

"hero-branch"  "arn:aws:iam::123456789012:role/hero-branch"

read as an aws trust policy · version 2012-10-17 · 654 bytes · 25 lines · 2 statements
sha256 486646b236d38df5328e81712df256c7e29fe9443db5591cf41064b528bdd490

A named outsider can assume this role.

  Anyone                exact               No grant is placed with people who have no account anywhere.
  Anyone on a platform  exact               No grant is placed at a whole platform.
  A named outsider      exact  grants 1, 2  aws:111122223333 and github:octo-org can assume this role and are not declared as yours.
  Your pipelines        exact               No grant is confined to owners declared as yours.
  Your people           exact               No grant trusts a SAML provider declared as yours.

Each of these can narrow the rings and was not read: the organisation's resource control policies, the calling accounts' service control policies and this account's identity providers.

grant 1 of 2 · statement[1] · Allow · aws:sts · outsider · exact
This role admits any AWS principal whose aws:principalaccount is 111122223333 and whose aws:principalarn is arn:aws:iam::111122223333:role/ci.
Who holds those identities now is not computed here: no network request is made.

CLAIM                 ADMITS                               IN WORDS · AS WRITTEN
aws:principalaccount  "111122223333"                       exactly this value · from Principal
aws:principalarn      "arn:aws:iam::111122223333:role/ci"  exactly this value · from Principal
any other claim       any                                  unconstrained · no condition names it

a token this grant admits
  {
    "aws:principalaccount": "111122223333",
    "aws:principalarn": "arn:aws:iam::111122223333:role/ci"
  }
The decoded payload. A claim not shown is unconstrained by this grant.

statement[1] · offset 501 · 146 bytes · lines 17-23 · issuer at line 19 Principal · sha256 5cd8a331cd7f757a0dbe3bd149324104fd359759a677e58829d7af212cc2fbff

grant 2 of 2 · statement[0] · Allow · https://token.actions.githubusercontent.com · outsider · exact
This role admits any token from token.actions.githubusercontent.com whose aud is sts.amazonaws.com and whose sub is repo:octo-org/deploy:ref:refs/heads/main.
Who holds those identities now is not computed here: no network request is made.

CLAIM            ADMITS                                      IN WORDS · AS WRITTEN
aud              "sts.amazonaws.com"                         exactly this audience · line 12 StringEquals
sub              "repo:octo-org/deploy:ref:refs/heads/main"  exactly this subject · line 13 StringEquals
any other claim  any                                         unconstrained · no condition names it

a token this grant admits
  {
    "iss": "https://token.actions.githubusercontent.com",
    "aud": "sts.amazonaws.com",
    "sub": "repo:octo-org/deploy:ref:refs/heads/main"
  }
The decoded payload. A claim not shown is unconstrained by this grant, but for azp. It sets no azp: AWS reads aud from azp whenever a token sets one.

statement[0] · offset 50 · 445 bytes · lines 4-16 · issuer at line 7 Principal.Federated · sha256 58505e3983888521e7ed32423c8e1324e5af3cc54c21f818cf3d3c80273f83eb

"hero-organisation"  "arn:aws:iam::123456789012:role/hero-organisation"

read as an aws trust policy · version 2012-10-17 · 663 bytes · 27 lines · 2 statements
sha256 66d1ff7db15de1fb0ff8eb767af52a1bcfb8be5ddf36e778ce38475b81b6c2a8

A named outsider can assume this role.

  Anyone                exact               No grant is placed with people who have no account anywhere.
  Anyone on a platform  exact               No grant is placed at a whole platform.
  A named outsider      exact  grants 1, 2  aws:111122223333 and github:octo-org can assume this role and are not declared as yours.
  Your pipelines        exact               No grant is confined to owners declared as yours.
  Your people           exact               No grant trusts a SAML provider declared as yours.

Each of these can narrow the rings and was not read: the organisation's resource control policies, the calling accounts' service control policies and this account's identity providers.

grant 1 of 2 · statement[1] · Allow · aws:sts · outsider · exact
This role admits any AWS principal whose aws:principalaccount is 111122223333 and whose aws:principalarn is arn:aws:iam::111122223333:role/ci.
Who holds those identities now is not computed here: no network request is made.

CLAIM                 ADMITS                               IN WORDS · AS WRITTEN
aws:principalaccount  "111122223333"                       exactly this value · from Principal
aws:principalarn      "arn:aws:iam::111122223333:role/ci"  exactly this value · from Principal
any other claim       any                                  unconstrained · no condition names it

a token this grant admits
  {
    "aws:principalaccount": "111122223333",
    "aws:principalarn": "arn:aws:iam::111122223333:role/ci"
  }
The decoded payload. A claim not shown is unconstrained by this grant.

statement[1] · offset 510 · 146 bytes · lines 19-25 · issuer at line 21 Principal · sha256 5cd8a331cd7f757a0dbe3bd149324104fd359759a677e58829d7af212cc2fbff

grant 2 of 2 · statement[0] · Allow · https://token.actions.githubusercontent.com · outsider · exact
This role admits any token from token.actions.githubusercontent.com whose aud is sts.amazonaws.com and whose sub matches repo:octo-org/*.
Who holds those identities now is not computed here: no network request is made.

CLAIM            ADMITS                  IN WORDS · AS WRITTEN
aud              "sts.amazonaws.com"     exactly this audience · line 12 StringEquals
sub              like:"repo:octo-org/*"  any subject beginning repo:octo-org/ · line 15 StringLike
any other claim  any                     unconstrained · no condition names it

a token this grant admits
  {
    "iss": "https://token.actions.githubusercontent.com",
    "aud": "sts.amazonaws.com",
    "sub": "repo:octo-org/"
  }
The decoded payload. A claim not shown is unconstrained by this grant, but for azp. It sets no azp: AWS reads aud from azp whenever a token sets one.

statement[0] · offset 50 · 454 bytes · lines 4-18 · issuer at line 7 Principal.Federated · sha256 00fbab06a697649f9c98bb6f0bb35494b10c359261a4e82120a9c8b750cbb37b

"hero-platform"  "arn:aws:iam::123456789012:role/hero-platform"

read as an aws trust policy · version 2012-10-17 · 662 bytes · 27 lines · 2 statements
sha256 43041b15a48b6212fd61751eb4b339205585f5618c2c967cf4d8fc6918696d7f

Anyone on GitHub can assume this role.

  Anyone            exact           No grant is placed with people who have no account anywhere.
  Anyone on GitHub  exact  grant 2  Anyone on GitHub can assume this role; no condition confines its tokens to one owner.
  A named outsider  exact  grant 1  aws:111122223333 can assume this role and is not declared as yours.
  Your pipelines    exact           No grant is confined to owners declared as yours.
  Your people       exact           No grant trusts a SAML provider declared as yours.

Each of these can narrow the rings and was not read: the organisation's resource control policies, the calling accounts' service control policies and this account's identity providers.

grant 1 of 2 · statement[1] · Allow · aws:sts · outsider · exact
This role admits any AWS principal whose aws:principalaccount is 111122223333 and whose aws:principalarn is arn:aws:iam::111122223333:role/ci.
Who holds those identities now is not computed here: no network request is made.

CLAIM                 ADMITS                               IN WORDS · AS WRITTEN
aws:principalaccount  "111122223333"                       exactly this value · from Principal
aws:principalarn      "arn:aws:iam::111122223333:role/ci"  exactly this value · from Principal
any other claim       any                                  unconstrained · no condition names it

a token this grant admits
  {
    "aws:principalaccount": "111122223333",
    "aws:principalarn": "arn:aws:iam::111122223333:role/ci"
  }
The decoded payload. A claim not shown is unconstrained by this grant.

statement[1] · offset 509 · 146 bytes · lines 19-25 · issuer at line 21 Principal · sha256 5cd8a331cd7f757a0dbe3bd149324104fd359759a677e58829d7af212cc2fbff

grant 2 of 2 · statement[0] · Allow · https://token.actions.githubusercontent.com · platform · exact
This role admits any token from token.actions.githubusercontent.com whose aud is sts.amazonaws.com and whose sub matches repo:octo-org*.
Who holds those identities now is not computed here: no network request is made.

CLAIM            ADMITS                 IN WORDS · AS WRITTEN
aud              "sts.amazonaws.com"    exactly this audience · line 12 StringEquals
sub              like:"repo:octo-org*"  any subject beginning repo:octo-org · line 15 StringLike
any other claim  any                    unconstrained · no condition names it

a token this grant admits
  {
    "iss": "https://token.actions.githubusercontent.com",
    "aud": "sts.amazonaws.com",
    "sub": "repo:octo-org"
  }
The decoded payload. A claim not shown is unconstrained by this grant, but for azp. It sets no azp: AWS reads aud from azp whenever a token sets one.

statement[0] · offset 50 · 453 bytes · lines 4-18 · issuer at line 7 Principal.Federated · sha256 9c4e176a4c3a74de820b26a153dba3bb56ef9eab5276dd8e153c50448ef4abda

"owner-prefix"  "arn:aws:iam::123456789012:role/owner-prefix"

read as an aws trust policy · version 2012-10-17 · 510 bytes · 20 lines · 1 statement
sha256 9a58b6422f7cae3537b3277f43a186274b584fc308d76cf2836e37dc780e908f

Anyone on GitHub can assume this role.

  Anyone            exact           No grant is placed with people who have no account anywhere.
  Anyone on GitHub  exact  grant 1  Anyone on GitHub can assume this role; no condition confines its tokens to one owner.
  A named outsider  exact           No grant is placed with a named outsider.
  Your pipelines    exact           No grant is confined to owners declared as yours.
  Your people       exact           No grant trusts a SAML provider declared as yours.

Each of these can narrow the rings and was not read: the organisation's resource control policies, the calling accounts' service control policies and this account's identity providers.

grant 1 of 1 · statement[0] · Allow · https://token.actions.githubusercontent.com · platform · exact
This role admits any token from token.actions.githubusercontent.com whose aud is sts.amazonaws.com and whose sub matches repo:octo-org*.
Who holds those identities now is not computed here: no network request is made.

CLAIM            ADMITS                 IN WORDS · AS WRITTEN
aud              "sts.amazonaws.com"    exactly this audience · line 12 StringEquals
sub              like:"repo:octo-org*"  any subject beginning repo:octo-org · line 15 StringLike
any other claim  any                    unconstrained · no condition names it

a token this grant admits
  {
    "iss": "https://token.actions.githubusercontent.com",
    "aud": "sts.amazonaws.com",
    "sub": "repo:octo-org"
  }
The decoded payload. A claim not shown is unconstrained by this grant, but for azp. It sets no azp: AWS reads aud from azp whenever a token sets one.

statement[0] · offset 50 · 453 bytes · lines 4-18 · issuer at line 7 Principal.Federated · sha256 9c4e176a4c3a74de820b26a153dba3bb56ef9eab5276dd8e153c50448ef4abda

"owner"  "arn:aws:iam::123456789012:role/owner"

read as an aws trust policy · version 2012-10-17 · 511 bytes · 20 lines · 1 statement
sha256 0a9e7b8f9907b3954e008260714a16cc831805e5e6ac719aca396c85cee6fe23

A named outsider can assume this role.

  Anyone                exact           No grant is placed with people who have no account anywhere.
  Anyone on a platform  exact           No grant is placed at a whole platform.
  A named outsider      exact  grant 1  github:octo-org can assume this role and is not declared as yours.
  Your pipelines        exact           No grant is confined to owners declared as yours.
  Your people           exact           No grant trusts a SAML provider declared as yours.

Each of these can narrow the rings and was not read: the organisation's resource control policies, the calling accounts' service control policies and this account's identity providers.

grant 1 of 1 · statement[0] · Allow · https://token.actions.githubusercontent.com · outsider · exact
This role admits any token from token.actions.githubusercontent.com whose aud is sts.amazonaws.com and whose sub matches repo:octo-org/*.
Who holds those identities now is not computed here: no network request is made.

CLAIM            ADMITS                  IN WORDS · AS WRITTEN
aud              "sts.amazonaws.com"     exactly this audience · line 12 StringEquals
sub              like:"repo:octo-org/*"  any subject beginning repo:octo-org/ · line 15 StringLike
any other claim  any                     unconstrained · no condition names it

a token this grant admits
  {
    "iss": "https://token.actions.githubusercontent.com",
    "aud": "sts.amazonaws.com",
    "sub": "repo:octo-org/"
  }
The decoded payload. A claim not shown is unconstrained by this grant, but for azp. It sets no azp: AWS reads aud from azp whenever a token sets one.

statement[0] · offset 50 · 454 bytes · lines 4-18 · issuer at line 7 Principal.Federated · sha256 00fbab06a697649f9c98bb6f0bb35494b10c359261a4e82120a9c8b750cbb37b