What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
GitHub Actions can access AWS without storing long-lived access keys: a workflow requests a short-lived OpenID Connect (OIDC) token, AWS IAM checks whether its claims match a role’s trust policy, and AWS Security Token Service (STS) returns temporary credentials if they do. The setup hinges on two separate policies: the trust policy decides which GitHub job may assume the role; the role’s permissions policy decides what that job may do in AWS.
How the GitHub-to-AWS trust chain works
- GitHub issues an identity token. The workflow job needs
id-token: writepermission to request a GitHub OIDC token. This permits requesting the token; it does not grant permission to change AWS resources. - AWS evaluates the token. An IAM OIDC identity provider represents GitHub, and the IAM role’s trust policy checks the token’s audience and subject claims against the conditions you set.
- STS returns temporary credentials. If the claims meet the trust policy, AWS STS lets the job assume the role. The role’s permissions policy then governs its AWS access.
For the official credentials action, the provider URL is https://token.actions.githubusercontent.com and the audience is sts.amazonaws.com. See GitHub’s AWS OIDC setup guide.
As an Amazon Associate I earn from qualifying purchases.
Set up the AWS role and GitHub workflow
1. Register GitHub as an IAM OIDC provider
In AWS IAM, add an OpenID Connect identity provider with the provider URL https://token.actions.githubusercontent.com. For use with aws-actions/configure-aws-credentials, configure sts.amazonaws.com as an accepted audience.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall2. Create a role with a narrow trust policy
Create or select an IAM role trusted by that provider. Require the audience claim to equal sts.amazonaws.com, and constrain the subject claim to the intended repository context. A branch-specific subject has the form repo:ORG/REPO:ref:refs/heads/BRANCH; replace each component with the actual owner, repository and branch.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A trust policy should not allow any repository to assume the role through a subject that is only a wildcard. AWS recommends limiting access to specific repositories or branches. Match the subject format the repository actually emits; immutable subject claims can change that format.
3. Give the role only the permissions deployment needs
Attach a permissions policy granting only the AWS actions and resources required by the deployment. For example, a job uploading a site to a particular S3 bucket needs the relevant access to that bucket, not broad account-wide permissions. The trust policy answers who may assume the role; the permissions policy answers what the assumed role may do.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Allow the workflow job to request an OIDC token
Set permissions at the workflow or job level. If the job checks out repository code, it commonly also needs contents: read. Keep other permissions no broader than the workflow requires.
5. Exchange the token for AWS credentials
Use aws-actions/configure-aws-credentials with the role ARN and AWS Region, then run the deployment command or AWS action. Review and pin the action revision in line with your repository’s security policy; GitHub’s example uses a full commit SHA.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
permissions:
id-token: write
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: aws-actions/configure-aws-credentials@<reviewed-commit-sha>
with:
role-to-assume: arn:aws:iam::<account-id>:role/<deployment-role>
aws-region: <region>
- run: aws s3 cp ./site s3://<bucket>/ --recursiveThis is an illustrative configuration, not a tested deployment. Replace the example values and verify the action revision, role policy, and trust conditions before using it. The credentials action is third-party software; consult its documentation and assess it under your organization’s action-security policy. GitHub’s workflow example and AWS instructions provide the setup context.
Choose a subject condition that matches the workflow
Branch or tag deployments
A branch or tag subject identifies a repository and ref, for example repo:ORG/REPO:ref:refs/heads/BRANCH. Use the exact repository and ref expected to deploy, rather than a broad pattern that also admits unrelated refs.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Deployments through a GitHub environment
When a job uses a GitHub environment, its subject identifies that environment, for example repo:ORG/REPO:environment:prod. In that case, protect the environment with deployment rules appropriate to your release process. The trust condition should match the environment subject, not assume that the branch-form subject applies.
Repositories using immutable subject claims
GitHub’s AWS guide says repositories created after July 15, 2026, or repositories that opt into immutable subject claims, use a subject containing immutable owner and repository IDs. Do not copy an older subject example blindly: check the subject emitted by the repository and make the IAM condition match it. The format is configuration-dependent, so the creation date alone is not a substitute for checking the actual claim. See GitHub’s current AWS OIDC guidance and its OIDC reference.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Important claim and event limitations
- Custom claims: GitHub’s AWS-specific guide says AWS does not support custom claims for OIDC. Build the trust policy from supported claims and IAM condition keys.
- Dependabot update jobs: GitHub’s AWS guide notes that OIDC tokens requested for Dependabot update jobs have
event_nameset todynamic. If your provider and policy use event-name conditions to restrict eligible events, account for that value explicitly. - Workflow permission scope: GitHub Docs explains that setting
id-token: writedoes not give the workflow permission to write to resources. AWS access still depends on successful role assumption and the role’s permissions policy.
For claim details, consult the GitHub OIDC reference. For AWS’s guidance on configuring an OIDC role and restricting its trust policy, see Create a role for OpenID Connect federation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
