Exchange a GitHub Actions OIDC token for AWS credentials using AssumeRoleWithWebIdentity

Steps

1. In the GitHub Actions workflow, add permissions: id-token: write to the job so the runner can request an OIDC token from GitHub's token endpoint
2. Create an IAM OIDC identity provider in AWS with the GitHub OIDC issuer URL (https://token.actions.githubusercontent.com) and verify the thumbprint list matches the current GitHub documentation
3. Create an IAM role with a trust policy that allows sts:AssumeRoleWithWebIdentity from the GitHub OIDC provider, scoping the Condition to sub claim values matching the specific repository or branch (e.g., repo:org/repo:ref:refs/heads/main)
4. In the workflow, use the official aws-actions/configure-aws-credentials action with the role ARN and region; the action exchanges the OIDC token for temporary STS credentials automatically
5. Validate the setup by running aws sts get-caller-identity in a subsequent step and confirming the assumed role ARN
6. Do not store AWS access keys in GitHub secrets; the entire point is to use short-lived credentials — audit your secrets list periodically to catch accidental key storage