How does GitHub deploy to AWS without stored AWS keys?

Say it in 30 seconds

Say it like this (20-30 seconds)

GitHub gives the job a signed OpenID Connect token. AWS STS checks the role’s trust policy and exchanges that token for temporary credentials. MiniTickets has separate publish and deploy roles: publishing trusts the repository’s main branch, while deployment trusts its environment subject. The permission policy then limits AWS operations. This removes long-lived AWS keys, but repository permissions and environment protection still decide who can reach that trust boundary.

The deeper answer

There are two questions: who may assume the role, and what that role may do. The trust conditions require the AWS audience and the expected GitHub subject. The publish job needs id-token: write to request the token; that permission does not grant repository write access.

A job using a GitHub environment has an environment-shaped subject rather than the ordinary branch subject. MiniTickets matches the deploy environment to the Pulumi stack. The deploy role is broader than the ECR publish role because it applies infrastructure.

An environment subject alone does not prove which branch or workflow produced it. Branch restrictions, required reviewers and self-review rules need their own protection settings. The repository bootstrap currently permits self-review; that limitation is documented rather than treated as a completed hardening step. I would also review third-party action pinning and what executable code runs after credentials become available.

Counter-questions

Why does AssumeRoleWithWebIdentity fail before an ECR call?

The trust exchange failed, so ECR permissions are not yet relevant. Compare issuer, audience and subject with the live trust policy.

Does OIDC make the deploy role harmless?

No. Temporary credentials can still exercise every permission the role grants while valid. Limit scope and protect the workflow.

Could another workflow use the environment role?

Potentially, if it can run with the matching environment subject and satisfy its protection settings. The subject is not a workflow identity.

Where in MiniTickets

Read the path chapter, select the relevant map piece →, then inspect infra/src/cicd.ts → createCicd. Work through the related case for a diagnostic example.