GitHub Actions OIDC to AWS: dropping long-lived access keys
Originally published on kuryzhev.cloud If your repository still has AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY sitting in GitHub Actions secrets, you are carrying a liability. Those keys rotate on nobody's schedule but an attacker's. GitHub Actions OIDC to AWS replaces that pattern with short-lived, per-run credentials issued by AWS STS. There is no long-lived key to leak, screenshot, or forget…
The article discusses the risks associated with using long-lived AWS access keys in GitHub Actions and how to migrate to a more secure method using OIDC (OpenID Connect) to AWS. The key points are:
1. Long-lived access keys in GitHub Actions secrets represent a liability as they can be leaked, stolen, or forgotten to rotate, making them vulnerable to attacks.
2. GitHub Actions OIDC to AWS introduces short-lived, per-run credentials issued by AWS STS (Security Token Service), eliminating the need for long-lived keys that can be compromised.
3. OIDC federation allows GitHub's token service to present a signed JWT (JSON Web Token) to AWS, which trusts the token due to a configured identity provider. AWS then returns temporary credentials using the configure-aws-credentials action.
4. It is recommended to create the OIDC provider once per AWS account, not per repository, to avoid duplication and AWS errors when creating duplicate providers.
5. The trust policy of the IAM role should be explicitly scoped to a specific repository, branch, environment, or pull-request context by matching on the sub claim in the token, which encodes this information. This prevents any workflow in any repository from assuming the role.
6. Granting broad AWS permissions due to a narrow trust policy is discouraged. The role should only have the necessary permissions for the specific tasks the pipeline performs, following the principle of least privilege.
7. Separate roles should be used for different environments or deployment stages, such as staging and production, to maintain distinct permission sets and prevent a compromised PR from widening its blast radius.
8. Explicit permissions should be set at the job or workflow level, with the id-token permission set to write, to ensure the OIDC token request succeeds. The contents permission should also be set accordingly for actions like checkout.
9. Avoid using the aws-actions/configure-aws-credentials action via @main tag, as this exposes it to potential supply-chain compromises. Instead, pin to a specific commit SHA for a stronger guarantee.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
