通过OIDC信任策略控制GitLab访问AWS角色遇问题求助

已为GitLab配置OIDC自定义信任策略，初始策略可正常运行，但添加gitlab.com:sub的Condition条件后出现权限验证失败问题，无法通过GitLab OIDC角色访问AWS资源。

初始可运行策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxx:oidc-provider/gitlab.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "gitlab.com:aud": "https://gitlab.com"
                }
            }
        }
    ]
}

修改后出现问题的策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxx:oidc-provider/gitlab.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "gitlab.com:aud": "https://gitlab.com"
                },
                "StringEquals": {
                    "gitlab.com:sub": "project_path:<project or group>"
                }
            }
        }
    ]
}

问题原因 #

JSON语法规则中，对象内的重复键会被最后一个键值对覆盖。修改后的策略在Condition下重复定义了StringEquals，导致gitlab.com:aud的校验条件被丢失，IAM策略解析异常，最终触发权限验证失败。

解决方案 #

将两个校验条件合并到同一个StringEquals对象中，确保两个条件会被同时执行校验：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::xxxx:oidc-provider/gitlab.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "gitlab.com:aud": "https://gitlab.com",
                    "gitlab.com:sub": "project_path:<project or group>"
                }
            }
        }
    ]
}

同时需确认project_path:<project or group>替换为实际的GitLab项目/组路径（格式示例：project_path:your-team/your-project），确保与GitLab OIDC Token中的sub字段完全匹配。

内容的提问来源于stack exchange，提问作者Hardik Patel