Authenticating GitHub Actions to AWS Without Stored Keys Using OIDC Federation

Long-lived AWS access keys stored in CI systems tend to go unrotated, outlive their projects, accumulate excess permissions, and leak easily. OIDC federation eliminates them by having each GitHub Actions run obtain a short-lived signed token that AWS exchanges for temporary credentials. Setup requires registering GitHub as an IAM identity provider once per account, then creating a role whose trust policy restricts access to specific repositories, branches, or environments. The resulting credentials last roughly an hour and are never stored in the repository. The guide also highlights that overly loose trust conditions can quietly undermine this security benefit.