Developer Replaces Permanent AWS Keys in GitLab CI/CD Using OIDC Federation

A developer replaced static AWS IAM access keys stored in GitLab CI/CD variables with OpenID Connect (OIDC) federation, eliminating the need to store or rotate permanent credentials. In the new setup, GitLab generates a short-lived OIDC token per job, which AWS STS verifies before issuing temporary credentials tied to a specific IAM role. AWS was configured to trust GitLab as an identity provider using Terraform, with IAM trust policies restricting access by project path, audience, and namespace ID. Four separate IAM roles were created across the project's repositories, each scoped to only the AWS permissions that pipeline requires. The approach reduces credential exposure risk, removes manual rotation overhead, and ensures temporary credentials expire automatically after each job.