GitHub Actions with OIDC
Deploy from GitHub Actions to AWS using short-lived OIDC credentials — no stored secret keys.
GitHub Actions is a popular CI/CD platform. The secure way to let it deploy to AWS is OIDC (OpenID Connect): GitHub proves the workflow's identity to AWS, which hands back temporary credentials. No long-lived access keys are ever stored in GitHub.
Why OIDC beats stored keys
- No secret access keys sitting in GitHub to leak.
- Credentials last minutes and are scoped to one role.
- Trust is pinned to your specific repo and branch.
Example
name: Deploy
on:
push:
branches: [main]
permissions:
id-token: write # required for OIDC
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/github-deploy
aws-region: us-east-1
- run: |
aws s3 sync ./dist s3://myapp-prod-web-2026 --delete
aws cloudfront create-invalidation --distribution-id E1EXAMPLE123 --paths '/*'When to use it
- A team deletes all AWS access keys from GitHub Secrets after switching to OIDC, eliminating the risk of a long-lived credential leak.
- A CI workflow uses OIDC to assume different IAM roles for dev and prod deployments based on the branch name, without storing separate secrets.
- A security audit shows zero long-lived AWS keys in any CI system because every pipeline authenticates via short-lived OIDC tokens.
More examples
Create OIDC provider for GitHub
Registers GitHub Actions as a trusted OIDC identity provider in IAM so AWS can validate tokens it issues.
aws iam create-open-id-connect-provider \
--url https://token.actions.githubusercontent.com \
--client-id-list sts.amazonaws.com \
--thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1IAM role trust policy for OIDC
Trust policy that allows only GitHub Actions workflows from a specific repo and branch to assume the IAM role via OIDC.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": { "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com" },
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
},
"StringLike": {
"token.actions.githubusercontent.com:sub": "repo:myorg/myapp:ref:refs/heads/main"
}
}
}]
}GitHub Actions workflow using OIDC
Uses the configure-aws-credentials action with OIDC to assume an IAM role — no secrets stored in GitHub.
permissions:
id-token: write
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/github-deploy
aws-region: us-east-1
- run: aws s3 sync dist/ s3://my-bucket/
Discussion