I stopped putting AWS keys in GitHub Secrets. Here's what I do instead.

Short summary

Instead of storing long-lived AWS credentials in GitHub Secrets, use OIDC federation so GitHub Actions requests temporary credentials on each run—no stored secrets needed. Configure your workflow to request a token and set up an AWS IAM role with a trust policy scoped to your repo; credentials auto-expire when the job ends. This eliminates rotation chores and shrinks your blast radius if GitHub is ever compromised.

• •Replace static AWS keys in GitHub Secrets with OIDC federation for keyless deployments
• •AWS IAM role trust policy must scope access to your specific repo to prevent misconfiguration
• •Temporary credentials auto-expire when GitHub Actions job completes, eliminating rotation burden

Generated with AI, which can make mistakes.