Senior LevelGit & GitHub
How does GitHub Actions OIDC assume AWS IAM roles without long-lived keys?
❓ Interview Prompt: Explain OpenID Connect (OIDC) federation, eliminating static AWS access keys, JWT token exchange, and AWS IAM Role Assumption.
OIDC issues short-lived JWT identity tokens to GitHub Actions workflows, allowing cloud providers (AWS, GCP) to authenticate jobs dynamically without static access keys.
Code Implementation Example
yaml
permissions:
id-token: write
steps:
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/DeployRole💡Keyless AWS IAM role assumption using GitHub Actions OIDC federation.
🎯 Interview Key Takeaway
Use GitHub Actions OIDC federation to assume AWS IAM roles dynamically, eliminating static access keys in secrets.
#OIDC#AWS IAM#Keyless Auth#Security#Senior
Back to all Git & GitHub Questions→