~/writing/notes/oidc-over-long-lived-keys
evergreenCI should never hold a cloud key
If a pipeline has an AWS access key, it will leak eventually. OIDC trust policies scoped to repo and branch remove the key entirely.
planted 1 min read
Rule: no AWS_ACCESS_KEY_ID in any CI secret store. GitHub Actions gets a short-lived role via OIDC, and the role's trust policy pins repo:owner/name:ref:refs/heads/main. Pull requests get a read-only plan role; only main can apply.
Checklist:
- trust policy condition on
sub, not justaud - one role per environment, never shared
- session duration ≤ 1h
Full walkthrough: Zero long-lived cloud keys: GitHub Actions → AWS with OIDC. Used in infra-ops: one Terraform + Ansible platform for dev, staging and prod.
Links from this note
Mar 26, 2026Zero long-lived cloud keys: GitHub Actions → AWS with OIDCHow to delete every AWS access key from your CI and your laptop, replace them with short-lived roles, and make the blast radius of a leaked secret exactly zero.Read Feb 20, 2026infra-ops: one Terraform + Ansible platform for dev, staging and prodRead