Deployment Architecture: GitHub Actions & AWS OIDC
In this phase of the lab, we transitioned from manual S3 uploads to an enterprise-grade automated deployment pipeline.
Why AWS OIDC with GitHub Actions?
- No Long-Lived Secrets: You do not need to generate or rotate
AWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEY. - Least Privilege Access: The IAM role is scoped specifically to this repository, branch, and destination S3 bucket.
- Auditable: Every deployment request creates CloudTrail events tied to GitHub's OIDC issuer claims.
Key Components
- AWS IAM OIDC Identity Provider: Configured with URL
https://token.actions.githubusercontent.comand audiencests.amazonaws.com. - IAM Role Trust Policy: Allows
sts:AssumeRoleWithWebIdentityconditioned onrepo:techcoachralph/aws-s3-livestream-website-demo:*. - GitHub Actions Workflow: Uses
aws-actions/configure-aws-credentials@v4withpermissions: id-token: write. - Amazon S3 Bucket: Configured for Static Website Hosting with public read policy or CloudFront Origin Access Control (OAC).