DevOps & CI/CD

GitHub Actions to AWS Keyless Auth with OIDC

DevOps & CI/CD diagram · made in Skemio

Flowchart showing GitHub runner requesting OIDC token, AWS STS validating token against IAM role trust policy, and returning temporary credentials.
Flowchart showing GitHub runner requesting OIDC token, AWS STS validating token against IAM role trust policy, and returning temporary credentials.
Open it in SkemioMake your own

What it shows

  • OpenID Connect replaces static credentials with short-lived tokens (max 1h)
  • Trust policy validates repository, branch, and organization claims strictly
  • Eliminates secret rotation overhead and reduces leak blast radius to zero

The takeaway

Keyless OIDC token exchange eliminates long-lived cloud credentials across your CI/CD pipelines.

More devops & ci/cd diagrams