Build Secure AWS Pipelines with GitHub Actions and OIDC

Course details

In this course, join senior cloud security engineer, speaker, instructor, and career advisor Damien Burks as he shows you how to modernize and secure CI/CD delivery by replacing long‑lived AWS credentials with identity federation through OpenID Connect (OIDC). In today’s cloud environments, traditional secrets‑based authentication increases risk, adds operational overhead, and makes pipelines difficult to audit. Damien covers the essentials of how OIDC works, why AWS advocates for it, and how to implement it step‑by‑step inside GitHub Actions workflows.

This course is an ideal fit for DevSecOps and DevOps engineers, cloud practitioners, software developers, security engineers, and site reliability engineers.

Learning objectives
Configure OIDC identity federation between GitHub Actions and AWS to securely authenticate workflows without storing long‑lived credentials.
Design, implement, and troubleshoot least‑privilege IAM trust policies that tightly control how pipelines assume roles and interact with AWS resources.
Eliminate hardcoded secrets and legacy credential patterns by applying OIDC‑based authentication in real CI/CD environments.
Troubleshoot and validate OIDC authentication flows using AWS CloudTrail event history logs, and GitHub Actions run output to confirm secure configuration.
Apply security best practices to prevent credential‑based attacks, including secret sprawl, privilege overreach, and repository compromise scenarios.

Concepts

Introduction

Fix insecure pipelines with federated identity

Establish Federated Identity with AWS

Run an insecure GitHub Actions pipeline using AWS access keys
Create an OIDC identity provider in AWS

Secure Pipeline Access with IAM Roles

Create an IAM role for CI CD authentication
Tighten IAM trust policy conditions using OIDC claims

Enable OIDC Using GitHub Actions

Configure GitHub environment variables
Explore AWS resources that are managed by the pipeline
Implement the OIDC-enabled deployment workflow
Create Terraform S3 state bucket
Run the pipeline

Validate and Troubleshoot

Review a failed pipeline run
Grant administrator access to the pipeline role
Understand the risks of overprivileged pipeline roles
Implement least privilege permissions for pipeline role
Validate the secure pipeline configuration

Conclusion

What's next