Frontdoor: find who can assume into your cloud accounts
A new GitHub project called frontdoor maps the federated trust paths that let external identities access cloud accounts, revealing critical security flaws.
Cloud security scanners typically inspect what is inside an account, but frontdoor focuses on the doors leading in. The tool maps the OIDC, SAML and cross-account trusts that let a GitHub repository, a CI pipeline or a SaaS vendor obtain credentials in a cloud account. It reads the trust policy and tells users exactly which repositories or branches are trusted.
The project, available on GitHub, uses a single binary and requires no database or configuration file. It runs in 30 seconds, using existing credentials from ~/.aws, gcloud auth application-default or az login. It writes nothing to disk and prints a report showing who can get in and how far they can travel across clouds.
Critical trust flaws
frontdoor scans for misconfigured trust policies that are easy to get wrong. A role that trusts a GitHub repository looks identical in an inventory whether the trust is pinned to one branch or left open to every repository. The tool flags when a trust policy places no condition on the subject claim, allowing anyone with a token from the issuer to assume the role.
"Condition": { "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com", "token.actions.githubusercontent.com:sub": "repo:acme/api:ref:refs/heads/main" } }
The tool found that any GitHub Actions tenant can assume the role/ci-deploy in an account, and one of these identities crosses from AWS into GCP to reach BigQuery datasets. This means a compromise of a single repository can lead to access to sensitive data in another cloud. The project reports two critical and one high severity finding in its initial scan.
Tracing cross-cloud paths
frontdoor follows the IAM service account token creator edges to the end of a chain, reporting the whole path and identifying the weakest link. Other scanners stop at the first hop, which can be unremarkable, such as a repository becoming a CI user with no privileges. The tool reveals the full chain, showing how a repository compromise can reach an owner role.
The project is feature complete for AWS, GCP and Azure, with 15 rules and cross-cloud chain detection. It requires Go 1.26 to build and is available via go install. Users can run frontdoor scan to generate the report and identify which bindings to remove to secure their cloud access.
Related
