Use the AWS credentials action without long-lived keys.

Section: OIDC and fork safety

Configure AWS credentials via OIDC

yaml
yaml
- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
    aws-region: us-east-1
Explanation

Pair this with an IAM role trust policy that trusts GitHub's OIDC provider and claims.

Learn the surrounding workflow

Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.

Related commands

Same sheet · prioritizing OIDC and fork safety
Enable OIDC token issuance
Grant `id-token: write` when using cloud federation.
OpenIn sheetyamlsame section
Authenticate to Google Cloud with OIDC
Use workload identity federation for GCP.
OpenIn sheetyamlsame section
Do not expose secrets to untrusted forks
Avoid unsafe patterns for public repo pull requests.
OpenIn sheetyamlsame section
Set least-privilege token permissions
Limit the default GITHUB_TOKEN scope.
Grant write access only where needed
Elevate token permissions on a specific job.
Expose a secret as an environment variable
Use the `secrets` context in step env.