PS-11417: Enforce the wildcard-subject guard in the GitHub OIDC module

terraform/modules/github-oidc-role/main.tf

@@ -15,10 +15,10 @@
 #     subs (`repo:owner/repo:*`) are a well-known GHA OIDC footgun: a forked
 #     PR push, a tag from a malicious actor, or an environment trick can
 #     mint a token whose `sub` matches the wildcard but should NOT be
-#     allowed to assume the role. The module's `subject_claims` validator
-#     also rejects empty lists. If you genuinely want StringLike, fork this
-#     module rather than weakening it -- forcing the fork makes the
-#     decision visible in code review.
+#     allowed to assume the role. The module's `subject_claims` validators
+#     reject empty lists and any sub containing `*` or `?`. If you
+#     genuinely want StringLike, fork this module rather than weakening
+#     it -- forcing the fork makes the decision visible in code review.
 #
 #   - StringEquals on `aud`. AWS STS requires `sts.amazonaws.com`; the
 #     `audience` variable exists for non-AWS audience reuse (Cognito,

terraform/modules/github-oidc-role/variables.tf

@@ -25,6 +25,11 @@ variable "subject_claims" {
     condition     = length(var.subject_claims) > 0
     error_message = "subject_claims must list at least one explicit sub; wildcard / empty allowlists are not supported."
   }
+
+  validation {
+    condition     = alltrue([for sub in var.subject_claims : !can(regex("[*?]", sub))])
+    error_message = "subject_claims must be exact sub strings; wildcard characters (* or ?) are not supported. The trust uses StringEquals, where they would be dead weight at best."
+  }
 }
 
 variable "permissions_policy_json" {