GitHub Actions Can Reach AWS via OIDC Without Stored Access Keys

Storing long-lived AWS access keys in GitHub Actions secrets creates rotation work and exposure risk. An alternative is OpenID Connect, which lets workflows request temporary AWS credentials instead. Under this setup, GitHub issues a signed token that AWS STS validates against an IAM identity provider and role trust policy before issuing credentials. The trust policy should be tightly scoped to specific repositories and branches, and the attached role should carry only the permissions it needs. Workflows must also grant the id-token: write permission, and common failures usually trace back to mismatched audiences, subject claims, or role ARNs.