Chapter 81: DevOps Projects Part 11: GitHub Actions GitLab CI Node Matrix Docker OIDC Terraform Runner Releases

81.4 Project 80: Deploy to AWS with OIDC no stored keys

By Ravindra Bagale Last updated: 28 October 2026

Friends, long-lived AWS keys in CI get leaked. Today we trust the forge OIDC issuer in IAM, assume a role from Actions, and deploy without access key secrets.

What you will build in this project

Create an IAM OIDC provider for the forge.
Trust a role to a specific repo.
Use aws-actions/configure-aws-credentials.
Deploy with short-lived creds.

1. Start from a real company story

At PhonePe in Pune, a leaked AKIA key from an Actions secret opened an S3 bucket to the world for hours.

Rough cost: about ₹2 crore in incident response and customer notices.

Asha removed static keys and switched every workflow to OIDC.

Today we wire that trust.

Picture 1: Actions job → OIDC token → IAM role assume → AWS API (no AKIA in secrets)

Ravindra Bagale's Tip

Students trust * on sub for every repo in the org. Pin the repo and branch in the condition. Keep that habit.

2. Start and prepare

Step 1: Why OIDC

Why: Static keys leak. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'OIDC lets AWS trust a short-lived token from Actions'

You will see:

OIDC lets AWS trust a short-lived token from Actions

What it means: Why.

Example 2: a2

Type this:

mkdir -p /tmp/gha80 && echo 'Today: IAM OIDC provider, role trust, configure-aws'

You will see:

Today: IAM OIDC provider, role trust, configure-aws

What it means: Scope.

Example 3: a3

Type this:

echo 'Goal: zero AKIA keys in Actions secrets'

You will see:

Goal: zero AKIA keys in Actions secrets

What it means: Goal.

Step 2: OIDC provider

Why: One per account. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: aws tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

echo 'aws iam create-open-id-connect-provider --url https://token.actions.githubusercontent.com --client-id-list sts.amazonaws.com'

You will see:

aws iam create-open-id-connect-provider --url https://token.actions.githubusercontent.com --client-id-list sts.amazonaws.com

What it means: Provider.

Example 5: b2

Type this:

printf '%s\n' 'Note: the issuer hostname is the forge OIDC endpoint' 'Thumbprint is managed by AWS for this provider in current docs' > /tmp/gha80/PROVIDER.txt && cat /tmp/gha80/PROVIDER.txt

You will see:

Note: the issuer hostname is the forge OIDC endpoint

What it means: Note.

Example 6: b3

Type this:

echo 'Create once per AWS account; reuse for many roles'

You will see:

Create once per AWS account; reuse for many roles

What it means: Once.

Step 3: Trust policy

Why: Pin the repo. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf json. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' '{' '  "Version": "2012-10-17",' '  "Statement": [{' '    "Effect": "Allow",' '    "Principal": {"Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"},' '    "Action": "sts:AssumeRoleWithWebIdentity",' '    "Condition": {"StringEquals": {' '      "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",' '      "token.actions.githubusercontent.com:sub": "repo:myorg/shop-api:ref:refs/heads/main"' '    }}' '  }]' '}' > /tmp/gha80/trust.json && grep sub /tmp/gha80/trust.json

You will see:

"token.actions.githubusercontent.com:sub": "repo:myorg/shop-api:ref:refs/heads/main"

What it means: sub pin.

Example 8: c2

Type this:

echo 'Replace myorg/shop-api with your org and repo names'

You will see:

Replace myorg/shop-api with your org and repo names

What it means: Replace.

Example 9: c3

Type this:

echo 'Avoid sub wildcards like repo:myorg/* unless a platform team owns it'

You will see:

Avoid sub wildcards like repo:myorg/* unless a platform team owns it

What it means: Wildcard.

3. Build the main pieces

Step 4: Permissions policy

Why: Least privilege. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: deploy rights. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' '{' '  "Version": "2012-10-17",' '  "Statement": [{' '    "Effect": "Allow",' '    "Action": ["s3:PutObject", "s3:ListBucket"],' '    "Resource": ["arn:aws:s3:::shop-web", "arn:aws:s3:::shop-web/*"]' '  }]' '}' > /tmp/gha80/perm.json && cat /tmp/gha80/perm.json

You will see:

"Action": ["s3:PutObject", "s3:ListBucket"],

What it means: Perm.

Example 11: d2

Type this:

echo 'Create role: aws iam create-role --role-name shop-api-gha --assume-role-policy-document file://trust.json'

You will see:

Create role: aws iam create-role --role-name shop-api-gha --assume-role-policy-document file://trust.json

What it means: Create role.

Example 12: e3x

Type this:

echo 'Attach perm.json with put-role-policy'

You will see:

Attach perm.json with put-role-policy

What it means: Attach.

Step 5: Workflow step

Why: configure-aws-credentials. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: YAML. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' 'permissions:' '  id-token: write' '  contents: read' 'steps:' '  - uses: actions/checkout@v4' '  - uses: aws-actions/configure-aws-credentials@v4' '    with:' '      role-to-assume: arn:aws:iam::123456789012:role/shop-api-gha' '      aws-region: ap-south-1' '  - run: aws s3 sync ./dist s3://shop-web/ --delete' > /tmp/gha80/workflow-snip.yml && cat /tmp/gha80/workflow-snip.yml

You will see:

role-to-assume: arn:aws:iam::123456789012:role/shop-api-gha

What it means: OIDC step.

Example 14: e2

Type this:

echo 'id-token: write is required for OIDC — do not forget it'

You will see:

id-token: write is required for OIDC — do not forget it

What it means: Perm.

Example 15: e3

Type this:

echo 'No AWS_ACCESS_KEY_ID in secrets anymore'

You will see:

No AWS_ACCESS_KEY_ID in secrets anymore

What it means: No keys.

Step 6: Verify assume

Why: Who am I. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: sts. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

echo 'aws sts get-caller-identity'

You will see:

aws sts get-caller-identity

What it means: Who.

Example 17: f2

Type this:

echo 'Arn should show assumed-role/shop-api-gha'

You will see:

Arn should show assumed-role/shop-api-gha

What it means: Expect.

Example 18: f3

Type this:

printf '%s\n' 'Acceptance: sync succeeds with OIDC and no AKIA secrets' > /tmp/gha80/ACCEPT.txt && cat /tmp/gha80/ACCEPT.txt

You will see:

Acceptance: sync succeeds with OIDC and no AKIA secrets

What it means: Gate.

4. Automate and verify

Step 7: Delete static keys

Why: Cleanup. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: remove secrets. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

echo 'Delete AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from Actions secrets'

You will see:

Delete AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from Actions secrets

What it means: Delete.

Example 20: g2

Type this:

echo 'Deactivate the IAM user access key in AWS too'

You will see:

Deactivate the IAM user access key in AWS too

What it means: Deactivate.

Example 21: g3

Type this:

echo 'Search org for remaining AKIA strings in workflows'

You will see:

Search org for remaining AKIA strings in workflows

What it means: Hunt.

Step 8: Branch limits

Why: Only main deploys. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: trust sub. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'sub ends with ref:refs/heads/main for prod role'

You will see:

sub ends with ref:refs/heads/main for prod role

What it means: Main.

Example 23: h2

Type this:

echo 'Use a separate role for staging with refs/heads/develop'

You will see:

Use a separate role for staging with refs/heads/develop

What it means: Staging.

Example 24: h3

Type this:

echo 'environment: production in the job adds forge protection rules'

You will see:

environment: production in the job adds forge protection rules

What it means: Environment.

Step 9: Debug

Why: Common failures. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: tips. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

printf '%s\n' 'Not authorized to perform sts:AssumeRoleWithWebIdentity' '→ check sub string and aud' 'Could not load credentials' '→ missing id-token: write' > /tmp/gha80/DEBUG.txt && cat /tmp/gha80/DEBUG.txt

You will see:

→ missing id-token: write

What it means: Debug.

Example 26: i2

Type this:

echo 'CloudTrail shows AssumeRoleWithWebIdentity events'

You will see:

CloudTrail shows AssumeRoleWithWebIdentity events

What it means: Trail.

Example 27: i3

Type this:

echo 'Session duration defaults are short — enough for one deploy'

You will see:

Session duration defaults are short — enough for one deploy

What it means: Duration.

5. Harden and accept

Step 10: Story PhonePe

Why: AKIA leak. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

printf '%s\n' 'At PhonePe in Pune, a leaked AKIA from Actions opened an S3 bucket for hours.' 'Asha removed static keys and switched every workflow to OIDC.' > /tmp/gha80/STORY.txt && wc -l /tmp/gha80/STORY.txt

You will see:

2 /tmp/gha80/STORY.txt

What it means: Story.

Example 29: j2

Type this:

echo 'Rough cost: about ₹2 crore in incident response and notices'

You will see:

Rough cost: about ₹2 crore in incident response and notices

What it means: Cost.

Example 30: j3

Type this:

echo 'Asha: PASS'

You will see:

Asha: PASS

What it means: Sign-off.

Step 11: Proof

Why: Files. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

ls /tmp/gha80

You will see:

ACCEPT.txt\nDEBUG.txt\nPERMS.txt\nPROVIDER.txt\nSTORY.txt\nperm.json\ntrust.json\nworkflow-snip.yml

What it means: Tree.

Example 32: k2

Type this:

grep id-token /tmp/gha80/workflow-snip.yml

You will see:

id-token: write

What it means: id-token.

Example 33: k3

Type this:

echo 'Next: Terraform plan on pull request project 81'

You will see:

Next: Terraform plan on pull request project 81

What it means: Bridge.

Step 12: Acceptance

Why: OIDC deploy without AKIA. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'IAM OIDC provider present'

You will see:

IAM OIDC provider present

What it means: Provider.

Example 35: z2

Type this:

echo 'Role trust pins repo and branch'

You will see:

Role trust pins repo and branch

What it means: Trust.

Example 36: z3

Type this:

echo 'No AKIA in Actions secrets'

You will see:

No AKIA in Actions secrets

What it means: Clean.

Check yourself

Q1. Who fixed PhonePe AKIA leak?

Asha

Q2. Auth style?

OIDC

Q3. Action?

configure-aws-credentials

Q4. Static keys?

Q5. Pin in trust?

repo

Q6. Cred lifetime?

short

Friends, you deployed to AWS with OIDC. Did you understand? Let us try it once more. Remove any leftover AKIA secrets from the repo and prove the workflow still works.

Lab: try at home

OIDC provider.
IAM role trust.
configure-aws step.
Deploy and delete static keys.

Recap

OIDC beats static keys.
Pin repo in trust.
Short-lived creds.
Least privilege role.
Delete AKIAs.