Keyless CI/CD with GitHub Actions and AWS OIDC
Removed static AWS credentials from CI by moving to OIDC-based authentication. Pipelines now assume a short-lived role to build images, push to ECR and deploy to EC2, with Snyk and Trivy scanning as blocking gates before anything ships.
- GitHub Actions
- OIDC
- AWS IAM
- ECR
- EC2
- Snyk
- Trivy
The problem
CI held long-lived AWS access keys in repository secrets. They never expired, they were valid from anywhere, and rotating them meant touching every workflow that used them.
How it works now
GitHub Actions requests an OIDC token, and AWS trusts that token through an IAM identity provider. The workflow assumes a role scoped to the repository and branch, and receives credentials that expire when the job ends.
Nothing long-lived is stored. There is no key to leak, and no rotation to forget.
Security gates
Snyk covers dependencies and SAST, Trivy scans the built image. Both run as blocking steps, so a critical finding fails the build rather than producing a warning nobody reads.