Use the AWS credentials action without long-lived keys.
Section: OIDC and fork safety
Configure AWS credentials via OIDC
yaml
yaml
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
aws-region: us-east-1Explanation
Pair this with an IAM role trust policy that trusts GitHub's OIDC provider and claims.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing OIDC and fork safety
Enable OIDC token issuance
Grant `id-token: write` when using cloud federation.
Authenticate to Google Cloud with OIDC
Use workload identity federation for GCP.
Do not expose secrets to untrusted forks
Avoid unsafe patterns for public repo pull requests.