GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix(aws): remove the AssumeRoleWithWebIdentity success rule by kryonsx · Pull Request #2777 · utmstack/UTMStack

Conversation

@kryonsx

@kryonsx kryonsx commented Sep 29, 2026

Copy link
Copy Markdown
Contributor

Why

AWS AssumeRole With Web Identity (CI or Kubernetes Token) alerts on every successful AssumeRoleWithWebIdentity. That call is how EKS service accounts (IAM roles for service accounts), CI OIDC federation and Cognito identity pools obtain AWS credentials, on every credential refresh (AssumeRoleWithWebIdentity). The CloudTrail record (IAM and STS in CloudTrail) carries nothing that distinguishes a forged or leaked token from normal use, and the rule grouped by the caller address and user, which change with each session. It alerted on routine machine activity until the rule flood guard switched it off.

A threshold does not help: credential refreshes scale with the number of pods and pipeline runs, not with misuse. De-duplicating by role or identity provider would leave one inventory alert per role each week, with no decision for an analyst to make. So the rule is removed. The startup definition sync deletes shipped rules whose names disappear, so deployments drop it.

What changes

  • Remove rules/cloud/aws/aws/aws_sts_assume_role_with_web_identity.yml and its entry in testdata/filter-contracts/aws.json.
  • The aws_raw.json case for this event now uses the documented WebIdentityUser record shape (an EKS service account, fabricated values) and asserts that no AWS rule matches it. The old case used an IAMUser identity, which AssumeRoleWithWebIdentity never records.
  • TestAWSRawContracts expects 81 AWS rules instead of 82.

Tests

go test ./... in plugins/alerts: all AWS and contract tests pass, including the realistic record normalizing to origin.user system:serviceaccount:payments:api with no rule match. TestBitdefenderActionResultRaw fails in the same way on untouched v11 (dda9d45a) and is unrelated.

🤖 Generated with Claude Code

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
kryonsx and others added 2 commits September 29, 2026 11:47
@kryonsx @claude
fix(aws): remove the AssumeRoleWithWebIdentity success rule
1e4a632 
A successful AssumeRoleWithWebIdentity is how EKS service accounts, CI OIDC
federation and Cognito identity pools obtain AWS credentials, on every
credential refresh. The record does not distinguish a forged or leaked token
from normal use, so the rule alerted on routine machine activity and the
rule flood guard switched it off.

The contract fixture now uses the documented WebIdentityUser record shape
(an EKS service account) and asserts that no AWS rule matches it; the AWS
rule count drops from 82 to 81.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@kryonsx @claude
test(aws): drop example credential ids from the web identity fixture
d410e6f 
The fixture copied AWS's documentation placeholders for the temporary
access key id and the assumed role id. They are not credentials, but
secret scanning reports the access key id pattern. The test does not read
either field, so remove them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@kryonsx
kryonsx marked this pull request as ready for review September 29, 2026 22:34
@kryonsx
kryonsx requested a review from a team September 29, 2026 22:34
@kryonsx
kryonsx merged commit 89cd26c into utmstack:v11 Sep 29, 2026
3 of 7 checks passed

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@kryonsx
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.