Replace Long‑Lived Secrets in GitHub Actions with Short‑Lived OIDC Tokens for AWS
Static AWS keys in GitHub secrets are hard to rotate and expose a large blast radius. This post explains how to replace them with short‑lived OIDC tokens, walks through an AWS setup, shows a real workflow, and discusses trade‑offs.