How to Deploy to a Private AWS EC2 Instance Using GitHub Actions, SSM, and OIDC

A software developer has documented building a fully automated CI/CD pipeline using GitHub Actions to deploy a multi-container Docker Compose application hosted on a private AWS EC2 instance with no public IP address. Because the server sits behind an Application Load Balancer in a private subnet, traditional SSH-based deployment methods were not viable, ruling out stored SSH keys or a bastion host. The solution combined AWS IAM OIDC for keyless, short-lived authentication with GitHub Actions, and AWS Systems Manager (SSM) to remotely execute commands on the unreachable server. The pipeline automatically builds, tests, and containerizes code on every push to the main branch, then orchestrates the full four-service Docker Compose stack — including PostgreSQL, a backend, a frontend, and Nginx — respecting health-check dependencies to prevent startup failures. Infrastructure was provisioned and managed using Terraform, which had already partially configured the required IAM and SSM resources.