GHSA-Q2F7-M237-V562 @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators

Impact: @hulumi/policies versions before 1.3.2 only checked exact AWS IAM StringLike/StringEquals condition operator keys in GOIDC1. Set-qualified operators such as ForAnyValue:StringLike could hide wildcard GitHub Actions OIDC sub conditions from the mandatory guardrail. Patched in 1.3.2: the AW...

PT-2026-83733

Name of the Vulnerable Software and Affected Versions @hulumi/policies versions prior to 1.3.2 Description Failure to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies allows attackers to bypass security guardrails. Specifically, the G OIDC 1 check only...