Question

Your team currently stores a long-lived AWS access key and secret in repository secrets to let a deployment workflow push artifacts to an S3 bucket. Security wants to eliminate stored cloud credentials entirely by using OpenID Connect (OIDC) federation with AWS IAM. Which combination of changes correctly configures the workflow to obtain short-lived AWS credentials via OIDC?

Accepted Answer

Add `permissions: id-token: write` (plus `contents: read`) to the job, and use `aws-actions/configure-aws-credentials` with a `role-to-assume` that trusts the GitHub OIDC provider — no AWS keys stored.

Answer

Add `permissions: id-token: read` to the job and pass the existing AWS access key and secret to `aws-actions/configure-aws-credentials` so they are refreshed automatically.

Answer

Store the AWS keys as organization secrets instead of repository secrets and add `permissions: contents: write` so the GITHUB_TOKEN can assume the role.

Answer

Create a fine-grained Personal Access Token with cloud scopes and reference it as `aws-oidc-token` in the workflow's `env` block.