GithubActionsSelfHosted

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "EnforceTrustedOIDCTenantVercel",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Resource": "*",
        "Condition": {
          "StringNotLikeIfExists": {
            "oidc.vercel.com:sub": "owner:<TEAM_SLUG>:*"
          },
          "Null": {
            "oidc.vercel.com:sub": "false"
          }
        }
      },
      {
        "Sid": "EnforceTrustedOIDCTenantSandBoxes",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Resource": "*",
        "Condition": {
          "StringNotEqualsIfExists": {
            "sandboxes.cloud:aud": "<ORGNAME>"
          },
          "Null": {
            "sandboxes.cloud:aud": "false"
          }
        }
      },
      {
        "Sid": "EnforceTrustedOIDCTenantDataChain",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Resource": "*",
        "Condition": {
          "StringNotLikeIfExists": {
            "studio.datachain.ai/api:sub": "credentials:<example-team>/*"
          },
          "Null": {
            "studio.datachain.ai/api:sub": "false"
          }
        }
      },
      {
        "Sid": "EnforceTrustedOIDCTenantCodeFresh",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Resource": "*",
        "Condition": {
          "StringNotLikeIfExists": {
            "oidc.codefresh.io:sub": "account:<account_id>:*"
          },
          "Null": {
            "oidc.codefresh.io:sub": "false"
          }
        }
      }
    ]
  }