World map

 

BM

World A2: Keys & Guards

OIDC from GitHub Actions

You will learn: to let one GitHub workflow borrow an AWS role, with no stored keys.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Kedai Kancil’s GitHub workflow must push an image to AWS. You met the answer in CI/CD World C3: a visitor badge, OIDC (OpenID Connect): The runner shows a visitor badge for one job. The cloud checks it and lends a key that expires when the job ends.. Why is it better than a stored key?

Watch

On the AWS side there are three parts. Put the whole setup in order.

First step at the top. Put these in order. Use the arrows, or drag.

  • In the workflow, allow id-token: write
  • Add GitHub as an OIDC identity provider in IAM
  • configure-aws-credentials swaps the badge for keys
  • Give the role a small permissions policy
  • Make a role whose trust policy names your repo

Watch

The role’s trust policy: The note on a role that says who may borrow it: a service, a user, or GitHub Actions. checks the badge. Tap the line that says which repo may borrow the role.

Tap the line that names the repo.

0 of 1 found

Try it

Each line is a possible sub value. Safe for a production deploy role, or needs work?

Swipe right for good, left for needs work. Or use the buttons.

1 / 4repo:kedai-kancil/shop:environment:production

Predict

You try to save a trust policy whose sub is just *. What does IAM do?

Check

The workflow is in, wearing role ci-deployer. It tries to delete the whole image shelf. Predict.

Read the request and its policies. Will AWS say Allow or Deny?

The request

Who
ci-deployer (role session)arn:aws:sts::111122223333:assumed-role/ci-deployer/run-42
Wants to
ecr:DeleteRepository
On
arn:aws:ecr:ap-southeast-5:111122223333:repository/kedai
Identity policy (key ring) · ecr-push
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:InitiateLayerUpload",
"ecr:UploadLayerPart",
"ecr:CompleteLayerUpload",
"ecr:PutImage"
],
"Resource": "arn:aws:ecr:ap-southeast-5:111122223333:repository/kedai"
}
]
}
Your guess:

You did it!

You can now let one GitHub workflow borrow an AWS role, with no stored keys.

Go deeper (optional)

GitHub repos made after 15 July 2026 put ids in the sub value, like repo:kedai-kancil@123/shop@456:…. Copy the exact format from your repo’s docs.

Real rep (IAM is free; budget alarm set first). Clean-up list: the role and the provider.

Real mission

  4. aws sts get-caller-identity

0 of 5 steps done · Your ticks are saved.