Recommended Free Tools
Use GitHub Actions OpenID Connect (OIDC) to replace stored, long-lived AWS access keys with temporary credentials issued for an IAM role. The workflow requests a GitHub-issued token, the AWS credentials action exchanges it with AWS Security Token Service (STS), and AWS checks the token against an IAM OIDC provider and the role’s trust policy. The role’s permissions—not the workflow’s id-token: write setting—determine what the resulting credentials can do.
How does GitHub Actions OIDC with AWS work?
GitHub Actions obtains an OIDC JSON Web Token (JWT) for a job that has permission to request one. The AWS credentials action presents that token to STS using web identity federation. AWS validates the token against the configured GitHub OIDC provider and the IAM role’s trust policy; if the checks pass, STS returns temporary credentials for the role. AWS evaluates those credentials using the role’s attached permissions.
As an Amazon Associate I earn from qualifying purchases.
For GitHub.com, the issuer URL is https://token.actions.githubusercontent.com. The official AWS credentials action uses the audience sts.amazonaws.com. See GitHub’s AWS OIDC setup guide and AWS’s overview of OIDC federation.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11This changes how the workflow obtains AWS credentials; it does not remove AWS authorization. A role with broad permissions remains powerful even when credentials are temporary.
#1 Best Overall
How do I remove AWS access keys from GitHub Actions?
- Confirm or create the GitHub OIDC provider in AWS IAM. Use the issuer URL
https://token.actions.githubusercontent.comand the audiencests.amazonaws.comfor the official credentials action. Create the provider in the AWS account that will contain the role, or confirm that the required provider is already present. - Create a dedicated IAM role with a restricted trust policy. The role must trust the GitHub OIDC provider and allow
sts:AssumeRoleWithWebIdentity. Set conditions for both the audience and subject. AWS recommends a restrictivesubcondition; its role setup guidance for OIDC federation warns that an overly broad subject can allow unintended repositories to assume the role. - Choose the subject that matches the deployment. For a branch-specific workflow, a subject can look like
repo:ORG/REPO:ref:refs/heads/BRANCH. For a workflow that uses a GitHub environment, it can look likerepo:ORG/REPO:environment:prod. Replace these illustrative values with the exact organization, repository, branch or environment in your setup. - Grant only the workflow job the token permission it needs. Add
id-token: writeat the job level when possible; use workflow-level permission only if multiple jobs need it. Keep other GitHub token permissions narrow as well. This permission lets a job request an OIDC token. It does not grant AWS resource access or permission to write AWS resources. - Configure the AWS credentials action. In the workflow, use
aws-actions/configure-aws-credentialswith the role ARN and AWS Region, then run the AWS CLI or SDK operations the job needs. Pin the action in accordance with your repository’s supply-chain policy; choose a currently approved version or commit rather than copying an old example pin without checking it. - Validate access before deleting the old secrets. Run the intended deployment and confirm it can assume the role and perform only its required AWS operations. Also verify that an unintended branch or repository cannot assume the role. After cutover, remove the obsolete AWS access-key secrets from the relevant GitHub repository or environment, and remove any remaining workflow references to them.
What should the GitHub OIDC trust policy sub be?
Set sub to the identity scope that should be allowed to assume the role. The exact claim value must match the token GitHub issues for that workflow. AWS’s OIDC role guidance recommends restricting GitHub’s subject rather than relying on an organization-wide or repository-wide wildcard.
- One branch or ref: A branch-specific subject limits role assumption to a particular repository ref, such as
repo:ORG/REPO:ref:refs/heads/BRANCH. This is a close fit when deployment should originate from one branch. - A GitHub environment: An environment subject, such as
repo:ORG/REPO:environment:prod, ties the subject to that environment rather than spelling out the branch in the IAM subject. Configure the environment’s protection rules, including eligible branches or tags as appropriate, so the environment itself is not an unrestricted route to deployment. - A broader repository scope: A wildcard can accommodate more refs, but it also broadens which workflows may qualify. Use it only when the deployment design requires that breadth, and understand which events and refs can reach the role.
For GitHub.com, the trust policy should also constrain token.actions.githubusercontent.com:aud to sts.amazonaws.com when using the official action. A conceptual condition set is:
Rank #2
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
"token.actions.githubusercontent.com:sub": "repo:ORG/REPO:ref:refs/heads/BRANCH"
}
}This is a fragment, not a complete role trust policy. Replace the sample subject with the exact claim for your workflow; environment-based deployments need their environment subject instead. Do not copy the example unchanged or treat a wildcard as the secure default.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which deployment and permission scope should I choose?
| Choice | What it limits | Trade-off |
|---|---|---|
| Branch-specific subject | Role assumption to the specified repository ref. | Precise for a single deployment branch; other intended refs need their own allowance. |
| Environment subject with protection rules | Role assumption to a workflow using the named environment; environment rules can restrict eligible branches or tags. | Centralizes deployment controls in GitHub, but the environment’s protections must be configured deliberately. |
| Repository-wide wildcard | A broader set of qualifying workflow subjects within the matched scope. | More flexible, but increases the set of workflows that may be able to assume the role. |
Job-level id-token: write |
Only the job that needs OIDC may request a token. | Usually the narrowest workable permission scope. |
Workflow-level id-token: write |
Jobs in the workflow may request a token, subject to their permissions. | Useful if multiple jobs need OIDC, but broader than a single-job grant. |
Whichever subject design you select, keep the IAM role’s AWS permissions scoped to the required resources and actions. OIDC constrains credential issuance; it does not narrow permissions attached to the role.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can change the subject format or token assumptions?
Immutable subject claims
GitHub’s AWS guide says repositories created after July 15, 2026, or repositories that opted in to immutable subject claims include immutable owner and repository IDs in sub. A trust condition written for the older owner-and-repository-name format may therefore fail to match. Check the actual subject format in GitHub’s OIDC reference and ensure the AWS condition matches it. GitHub states that this immutable format is not available on GitHub Enterprise Server.
GitHub Enterprise Server
This guide covers GitHub.com. GitHub Enterprise Server uses an issuer based on the instance hostname path and has different setup requirements, including self-hosted runners; do not reuse the GitHub.com issuer or provider configuration without following the relevant GitHub OIDC reference.
Custom claims and Dependabot
AWS does not support evaluating custom OIDC claims for this integration, so do not build the IAM trust policy around custom claims. GitHub also notes that OIDC tokens requested for Dependabot update jobs have an event_name claim of dynamic. If your trust strategy uses event-based conditions, verify the relevant claim and AWS condition support before relying on it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
