World map

 

BM

World A4: Containers in the Cloud

Deploy from GitHub Actions with OIDC

You will learn: to push Kedai Kancil's image to ECR and roll it out on ECS from GitHub Actions, with no stored AWS keys.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Your workflow must push a new image to ECR and update the ECS service. It needs AWS keys. Which ones?

Watch

This is OIDC (OpenID Connect): The runner shows a visitor badge for one job. The cloud checks it and lends a key that expires when the job ends., as in CI/CD World C3, now aimed at AWS. Put one deploy in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • AWS lends short-lived role keys
  • AWS checks the repo and environment
  • The job asks GitHub for an ID token
  • The job pushes the image to ECR
  • ECS rolls out new tasks

Watch

The role’s trust policy says which badges it accepts. Tap the line that allows only one repo and one environment.

Tap the line that limits who may borrow the role.

0 of 1 found

Try it

Build the deploy workflow. No stored keys.

Tap blocks to add them. Put them in order.

Blocks

Your workflow

Tap a block above to start.

Workflow file .github/workflows/

name: Deploy to ECS

What runs

Nothing to run yet.

Predict

Someone pushes to a test branch without the production environment. Their job asks for the role. What happens?

Check

The deploy role may update the service. Now a run tries to delete it. Will AWS allow it?

Read the request and its policies. Will AWS say Allow or Deny?

The request

Who
kedai-deploy (role session)arn:aws:sts::111122223333:assumed-role/kedai-deploy/run-7
Wants to
ecs:DeleteService
On
arn:aws:ecs:ap-southeast-5:111122223333:service/kedai/shop
Identity policy (key ring) · deploy-shop
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["ecs:UpdateService", "ecs:DescribeServices"],
"Resource": "arn:aws:ecs:ap-southeast-5:111122223333:service/kedai/shop"
}
]
}
Your guess:

You did it!

You can now deploy to ECS from GitHub Actions, with no stored keys.

Go deeper (optional)

The full role also needs ECR push rights, ecs:RegisterTaskDefinition and iam:PassRole for the task roles. GitHub’s guide pins the ECS steps to exact commits, as here. Newer repos may use another subject format. Copy the exact one from GitHub’s OIDC docs.