GitHub's New OIDC Token Format for Fresh Repos Breaks AWS IAM Trust Policies

·1 views

GitHub has begun issuing OIDC tokens with a new subject claim format for newly created repositories, embedding numeric organization and repository IDs instead of using plain org/repo names. This change causes AWS IAM trust policies that rely on the classic subject pattern to fail, blocking GitHub Actions workflows from assuming IAM roles via OIDC federation. The error surfaces as a silent trust policy mismatch during the credentials step, with no indication from the GitHub side that anything is wrong. Developers can fix the issue by updating the IAM trust policy's StringLike condition to accept both the legacy and new subject claim formats as a list. Notably, renaming the repository does not resolve the problem, as the embedded numeric IDs are immutable by design and persist through renames.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer's Week-Long Real-Work Test of Kimi K3 Yields Mixed but Positive Verdict

A developer spent a week using Kimi K3, an open-weight AI model, for daily real-world tasks rather than controlled benchmarks or demos. The model reportedly performed well in frontend coding and topped the nextjs.org/evals leaderboard, becoming the first open model to outperform all proprietary competitors on that benchmark. Its large context window was noted as a genuine feature rather than a marketing claim. Agentic capabilities were described as useful but not exceptional, falling short of being transformative. The developer highlighted the significance of Kimi K3's open-weight nature as a key advantage for the broader AI community.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Key Cybersecurity Tools Beginners Should Start With, According to Experts

A new guide published on CoderLegion aims to help cybersecurity beginners identify the right tools to start their learning journey. The article follows a previous piece on building a cybersecurity roadmap, this time focusing on practical, hands-on resources. The author cautions newcomers against the common mistake of trying to adopt complex setups like Kali Linux and multiple scanners all at once. Instead, the guide advocates for a more gradual, focused approach to tool selection. The write-up is intended as an accessible starting point for those entering the cybersecurity field.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer shares framework for testing 200+ AI prompts used to run a SaaS

A SaaS founder has shared lessons from writing and testing over 400 AI prompts over the past year to handle tasks like copywriting, code reviews, cold outreach, and customer support. According to the author, most prompts fail for three core reasons: lack of specificity, missing context, and never being systematically tested across multiple runs. The author advocates a four-part prompt structure consisting of Role, Context, Constraints, and Output Format to improve AI output quality. A key insight highlighted is that explicitly stating what to avoid in a prompt — such as clichéd phrases — often improves results more than positive instructions alone. The post includes example prompts and is published on DEV Community, with the author also offering a curated paid prompt pack.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cloudflare vs. Wordfence: Choosing the Right Bot-Blocking Layer for WordPress

WordPress sites in 2026 face growing pressure from AI-driven bot traffic that scrapes content, probes forms, and strains server resources. Cloudflare operates as a reverse proxy at the network edge, blocking malicious requests before they reach the origin server, reducing compute and bandwidth costs at scale. Wordfence, by contrast, is a WordPress plugin that inspects requests at the application level, offering deeper context-awareness but consuming server resources for every incoming request. Each approach has trade-offs: edge filtering is efficient but coarse-grained, while endpoint filtering is thorough but potentially vulnerable during high-volume attacks. Many high-traffic WordPress deployments combine both layers, using Cloudflare to eliminate known threats early and Wordfence to catch sophisticated attacks that slip through.

0 comments Read more at DEV Community