# Getting your GitHub Actions AWS security posture straightened out with OIDC

DevFeed: [Getting your GitHub Actions AWS security posture straightened out with OIDC](<https://devfeed.tech/articles/getting-your-github-actions-aws-security-posture-straightened-out-with-oidc-23970.md>)

Original publisher: [Read original article](<https://medium.com/making-meetup/getting-your-github-actions-aws-security-posture-straightened-out-with-oidc-31ae1da23c16?source=rss----6981e268ba45---4>)

Author: Doug Tangren

Published: 2024-01-22T14:42:26Z

Content type: tutorial

Language: en

Sources: [Making Meetup - Medium](<https://devfeed.tech/sources/making-meetup-medium.md>)

Topics: [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Security](<https://devfeed.tech/topics/security.md>), [Automation](<https://devfeed.tech/topics/automation.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>)

Tags: [automation](<https://devfeed.tech/tags/automation.md>), [aws](<https://devfeed.tech/tags/aws.md>), [command-line](<https://devfeed.tech/tags/command-line.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This tutorial explains how Meetup uses OpenID Connect to authenticate GitHub Actions workflows with AWS instead of storing static AWS credentials. It describes provisioning an OIDC provider and IAM roles with an AWS SAM template, establishing trust between GitHub and an AWS account, and configuring role permissions for each repository.

## Source excerpt

Photo by Roman Synkevych on Unsplash Without a doubt at this point everyone should be deploying their AWS infrastructure through some form of automation. Tools to do so are both numerous and ubiquitous. At Meetup, we use GitHub Actions as a workflow automation tool and AWS SAM CLI to deploy the majority of our AWS infrastructure defined within templates. Because you're giving machines the power to both hoist and tear down you're sails it's behooving to be mindful of the security guardrails you've set up to minimize what could possibly go wrong were those to fall into the wrong hands. Using a common but native approach authenticate with AWS from your GitHub Actions workflow like storing static AWS credentials within GitHub Actions opens the door to leaking access in one way or another which others can exploit. AWS actually has a recommendation on this and that is to use OIDC instead. This is also a recommendation of GitHub themselves. We'd like to share our recipe for how we manage our AWS infrastructure management automation securely. While you can read more about how OIDC works here, I'll spare the details in this post to focus instead on the steps you can take to bootstrap your own setup so you can get off to the races quickly. First you'll need to provision a few AWS resources that define and grant a trust model between your AWS account and GitHub's servers. Below is a SAM template to do just that. AWSTemplateFormatVersion: "2010-09-09" Parameters: Repository: Type: String #👇 OIDCProvider's are account level and there can be only one per URL but you may choose to provision more than one role for each GH repo CreateProvider: Type: String Default: "true" AllowedValues: - "true" - "false" Conditions: ShouldCreateProvider: !Equals - !Ref CreateProvider - "true" # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services Resources: # 👇 create an OIDCProvider usedto trust GitHub's servers # https