← GitHub Actions OIDC Trust Policy Checker
Two different layers: Wiz continuously inventories a whole cloud account's IAM roles and trust relationships, alongside dozens of other cloud risk categories, as part of a paid platform. This tool reads one pasted trust policy's GitHub Actions OIDC conditions, once, locally — no account, no cloud connection, nothing installed.
Wiz is a cloud-native application protection platform
(CNAPP). Per its own public material, it connects agentlessly to a
customer's AWS, Azure, GCP, or other cloud accounts and builds a graph
correlating roles, permissions, workloads, data, vulnerabilities, and
exposed secrets across the whole environment, surfacing risks such as
over-permissive IAM trust policies as one of many finding types. Wiz's
own security research team has published specifically on GitHub
Actions OIDC trust-policy misconfigurations — a missing or
wildcarded sub condition letting an unintended repository
assume a role — as one instance of the broader IAM risk category
its platform inventories continuously. Wiz publishes no public price
list on its own site, so no dollar figure for it is stated here as
verified fact; only its well-documented product category (an
enterprise, account-connected CNAPP) is described.
This tool does none of what Wiz does. It connects to no cloud account,
runs no agent, and holds no ongoing inventory of anything. You paste
one AWS IAM role trust policy — the one federating GitHub
Actions over OIDC — and it classifies that policy's
sub and aud conditions against the specific
wildcard-scope and operator-semantics traps this misconfiguration
class is known for: no sub condition at all, a wildcard
reaching past one repository, repo:owner/name:* admitting
a fork's pull request, a negated operator, a missing or wildcarded
aud, and a literal * under
StringEquals that makes the role unassumable rather than
open. It runs free in your browser (or as a zero-dependency CLI), with
nothing uploaded and no network calls of its own.
| Question | Where to answer it |
|---|---|
| I want continuous, account-wide inventory of every IAM role's trust relationships, correlated against workloads, secrets, and vulnerabilities — not just one GitHub Actions role. | Wiz, or a comparable CNAPP — that is the ongoing, cross-account job it is built for. |
| I just wrote (or inherited) one AWS IAM role trust policy for GitHub Actions OIDC and want to know right now whether its sub/aud conditions actually pin it to my repo. | This tool — paste the policy, get the findings, free, no account. |
| I want an agent or connected account that watches my whole cloud estate for new over-permissive roles as they're created. | Wiz — this tool has no memory between runs and connects to nothing. |
| I don't want to connect a cloud account or install anything to check one trust policy that names my own AWS account id. | This tool — it never makes a network call, and nothing you paste is uploaded. |
| I want correlated findings across IAM, secrets, vulnerabilities, and data exposure in one graph. | Wiz — this tool checks one narrow, specific misconfiguration class and nothing else. |
| What exactly is the sub/wildcard trap, and how do I fix it? | This tool's own sub-claim and wildcard traps explainer. |
A team can reasonably use both: Wiz for continuous, account-wide cloud security posture management, and this tool as a fast, zero-account, zero-network check of one trust policy's OIDC conditions the moment it's written. This page does not evaluate Wiz's detection accuracy or coverage and makes no claim about it either way — it only describes Wiz's documented product category and states what this tool does differently. A clean result from either one is not a complete security assessment on its own.
This tool needs no account and no sign-in: it is a static page, the check runs in your browser (or as a stdlib-only CLI script), and it keeps working with the network connection off.
Not in the way this tool does. Wiz is a cloud-native application protection platform (CNAPP): per its own public material, it connects to a customer's cloud accounts (AWS, Azure, GCP and others) and continuously maps relationships across every role, permission, and resource to surface risks such as over-permissive trust policies, alongside a broad range of other cloud misconfigurations, vulnerabilities and exposed secrets. Wiz's own security research team has specifically written about the exact class of bug this tool checks for -- a GitHub Actions OIDC trust policy whose sub condition is missing or too broad, letting an unintended repository assume the role -- as one finding among the many categories its platform inventories across a whole account. This tool does the opposite and narrower thing: it makes no connection to any cloud account and holds no ongoing inventory. You paste one IAM role trust policy, and it classifies that policy's sub and aud conditions against the specific wildcard and operator-semantics traps documented for this exact misconfiguration, entirely offline.
They work at different layers, and a team can reasonably use both. Wiz connects to a cloud account on an ongoing, agentless basis and correlates findings across IAM, workloads, data, and vulnerabilities into one graph, as part of a paid enterprise platform; no public price list exists on Wiz's own site, so no dollar figure is stated here as verified fact. This tool needs no cloud account connection, no agent, and no ongoing subscription: paste one trust policy and get its sub/aud conditions classified in your browser, free, in under a second, with nothing uploaded. A platform team standardizing least-privilege across every role in a large cloud estate is better served by Wiz or a comparable CNAPP; a developer wiring up one new GitHub Actions OIDC role right now, who wants an immediate, free, local answer to whether its trust policy is scoped correctly, is in the right place here.
No. This page is not affiliated with, endorsed by, or sponsored by Wiz, Inc. Wiz is a trademark of its owner, named here only to describe what this tool is and is not, based on Wiz's own publicly documented product and research.
Open the GitHub Actions OIDC Trust Policy Checker to check your own policy, or read sub-claim and wildcard traps for the full mechanism.