Short-Lived Credentials: Eliminating Long-Lived AWS Keys with GitHub OIDC

The Danger of Static Access Keys

When engineers store AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY inside repository secrets, rotation is neglected and credentials persist indefinitely. If a pipeline is misconfigured or a third-party action is compromised, those credentials can be exfiltrated.

With OIDC federation, GitHub acts as an Identity Provider (IdP). AWS validates short-lived JSON Web Tokens (JWT) signed by GitHub's certificate authority, minting temporary STS credentials valid for only 15 to 60 minutes.

Trust Policy Condition Scoping

To prevent arbitrary repositories from assuming your roles, the IAM trust policy must strictly match both the GitHub organization and the target branch name:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:wvrner/*:ref:refs/heads/main"
        }
      }
    }
  ]
}

Zero Stored Secrets in CI

With this configuration, CI workflows request temporary credentials directly from AWS STS using standard GitHub action steps. No developer ever handles, copies, or rotates an AWS key again.