September 22, 2026 路 #6
Keys that outlive the pipeline
A GitHub Actions workflow needs to push an image to ECR. Which setup should you ship?
Next puzzle in UTC
One try. The first answer sticks.
How to fix it
OIDC gives each job a short-lived credential scoped to the workflow. Long-lived keys in secrets or files survive forks, logs, and people leaving the team.
Long-lived access keys are how cloud accounts leak through CI. They get copied into composite actions, printed by a debug step, or left behind when someone forks the repository. A private repository is not an access boundary for a secret that the workflow materializes in the runner environment.
GitHub can mint an OIDC token for the job. AWS STS exchanges that token for role credentials that die when the job ends. The trust policy should require token.actions.githubusercontent.com:sub to match the repository and the branch or environment you expect, not repo:your-org/*.
Fix
permissions:
id-token: write
contents: read
steps:
- uses: aws-actions/configure-aws-credentials@<pinned-sha>
with:
role-to-assume: arn:aws:iam::123456789012:role/gha-ecr-push
aws-region: us-east-1
Pin that action to a SHA. Scope the role to ecr:GetAuthorizationToken and the push actions on one repository, not AmazonEC2ContainerRegistryPowerUser on *.