Authenticating GitHub Actions to AWS Without Access Keys (OIDC)
While being mentored on GitHub Actions recently, my mentor told me to use OIDC to authenticate to AWS. I honestly had no idea you could authenticate without a static access key, so I dug deeper. It turns out GitHub OIDC lets your workflows get short-lived AWS credentials for each run instead of storing long-lived access keys. It's more secure, and there are no credentials to rotate or manage.…
Authenticating GitHub Actions to AWS without using access keys can be achieved through OpenID Connect (OIDC). This method allows workflows to obtain short-lived AWS credentials for each run, enhancing security and eliminating the need for long-lived access keys that require rotation and management.
To set up OIDC-based authentication, you need an AWS account with the ability to create IAM roles and identity providers, a GitHub repository with GitHub Actions enabled, and basic familiarity with GitHub Actions workflows. The key components involved are:
1. An OIDC (OpenID Connect) provider that allows AWS to trust GitHub's tokens.
2. An IAM (Identity and Access Management) role that the workflow assumes.
3. A trust policy that defines which GitHub repository and branch can assume the role.
4. A permission policy specifying the actions the role can perform.
5. A GitHub Actions workflow that assumes the IAM role.
The setup process includes the following steps:
1. **Create the OIDC Provider**: In the AWS Console, navigate to IAM → Identity providers → Add provider and fill in the details, such as the provider type (OpenID Connect), provider URL (https://token.actions.githubusercontent.com), and the audience (sts.amazonaws.com). This step needs to be done only once per AWS account.
2. **Create the IAM Role and Trust Policy**: Go to IAM → Roles → Create role, choose Web identity, and select the previously created provider with the audience sts.amazonaws.com. The trust policy should restrict which GitHub repo and branch can assume the role. It should be custom-tailored to the specific repo and branch, avoiding wildcards.
3. **Attach a Permission Policy**: Attach a policy with only the necessary permissions for the workflow. For example, to allow the workflow to list and upload files to an S3 bucket, you would create a policy with the required actions and resources.
4. **Set Up the GitHub Actions Workflow**: Create a workflow file (e.g., .github/workflows/aws-oidc.yml) with the necessary steps, including checking the identity using the `aws sts get-caller-identity` command. Once pushed to the main branch, the output should display the IAM role's ARN, confirming successful setup.
This method ensures that no access keys are stored in GitHub secrets, reducing the risk of leakage and eliminating the need for key rotation. Instead, workflows receive temporary credentials that expire after each run, providing a more secure and manageable authentication process.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
