Listen to this Post
When working with external tools that require access to your AWS accounts, you should always use temporary credentials and avoid hardcoding access key pairs. Many tools support direct OpenID Connect (OIDC) integrations, including GitHub Actions and workflows.
With temporary credentials, the external tool requests a short-lived token. If AWS validates the request as legitimate and from an expected entity, it issues the token. To revoke access, simply remove the OIDC trust relationship in your AWS account.
Dhilipsingh G demonstrates how to configure this securely between AWS and GitHub Actions using Terraform:
Infra provisioning GitHub Action with OIDC and Terraform
You Should Know:
1. Setting Up OIDC in AWS IAM
To configure OIDC for GitHub Actions:
1. Create an Identity Provider in AWS IAM:
aws iam create-open-id-connect-provider \ --url https://token.actions.githubusercontent.com \ --client-id-list sts.amazonaws.com \ --thumbprint-list <GITHUB_OIDC_THUMBPRINT>
2. Define an IAM Role with Trust Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
"token.actions.githubusercontent.com:sub": "repo:your-org/your-repo:ref:refs/heads/main"
}
}
}
]
}
2. GitHub Actions Workflow Using OIDC
name: AWS Deployment via OIDC jobs: deploy: runs-on: ubuntu-latest permissions: id-token: write contents: read steps: - uses: actions/checkout@v3 - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@v2 with: role-to-assume: arn:aws:iam::123456789012:role/github-oidc-role aws-region: us-east-1 - run: aws sts get-caller-identity
3. Revoking Access
To remove OIDC trust:
aws iam delete-open-id-connect-provider \ --open-id-connect-provider-arn arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com
4. Security Best Practices
- Rotate Credentials Frequently:
aws iam rotate-access-key --user-name GitHubUser
- Audit IAM Roles:
aws iam list-roles --query 'Roles[?AssumeRolePolicyDocument!=null]'
- Enable AWS CloudTrail Logging:
aws cloudtrail create-trail --name GitHubOIDCTrail --s3-bucket-name my-log-bucket
What Undercode Say
Temporary credentials via OIDC enhance security by eliminating long-term AWS keys. Using GitHub Actions with OIDC ensures least-privilege access while maintaining auditability. Always enforce conditional IAM policies, monitor STS activity via CloudTrail, and automate credential rotation.
Expected Output:
A secure, automated AWS-GitHub CI/CD pipeline using OIDC without hardcoded credentials.
Prediction
OIDC-based authentication will become the standard for DevOps workflows, reducing key leakage risks and improving compliance in cloud environments.
References:
Reported By: Darryl Ruggles – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
