使用oidc通过信任策略控制访问

Question

我与gitlab一起为OIDC创建了自定义策略。以下是政策，

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxx:oidc-provider/gitlab.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "gitlab.com:aud": "https://gitlab.com"
                }
            }
        }
    ]
}

以上工作正常，但我需要控制从gitlab的访问。

我试过如下，

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxx:oidc-provider/gitlab.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "gitlab.com:aud": "https://gitlab.com"
                },
                "StringEquals": {
                    "gitlab.com:sub": "project_path:<project or group>"
                }

            }
        }
    ]
}

根据上面的政策，我们可以在这里添加什么或与我的一方有什么意见吗？

​

​

Answer 1

我用过的解决方案，

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxx:oidc-provider/gitlab.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "gitlab.com:aud": "https://gitlab.com",
              "gitlab.com:sub": "project_path:<project or group>"
                }

            }
        }
    ]
}