Lion Cipher Lab
Kill long-lived AWS keys in CI: federate GitHub Actions with OIDC
- Cloud Security
- Intermediate
- ~45 min
- Free · no account required
Why it matters
A stored AWS access key in GitHub Secrets is a long-lived credential: it works from anywhere, it never expires on its own, and if it leaks in a log, a fork, or a compromised dependency, an attacker has your account until a human notices and rotates it. OIDC federation deletes that secret entirely — GitHub mints a fresh, short-lived token per run and AWS trades it for temporary role credentials that expire in minutes. The same pattern federates any CI to any cloud (GCP Workload Identity Federation, Azure), so learning it once removes static cloud keys from your whole pipeline. But the trust…
What you'll learn
- OpenID Connect (OIDC) federation for CI/CD
- creating an IAM OIDC identity provider for GitHub Actions
- writing an AssumeRoleWithWebIdentity trust policy
- pinning the token `sub` and `aud` claims (StringEquals vs StringLike)
- recognizing and closing the confused-deputy footgun in CI trust policies
- keyless AWS auth from a workflow with configure-aws-credentials
Steps in this lab
- The problem: a stored key is a standing invitation
- How OIDC federation replaces the key
- Register GitHub as an OIDC identity provider in IAM
- Create the role — and pin the subject correctly
- The workflow: request a token, assume the role, prove it
- Verify — then make the control fire
- When to federate, when it's overkill, and how to do it better