Static AWS keys in CI are a footgun.
If you want cloud automation that scales (and passes security review), use OIDC-based federation:
- GitHub Actions issues a short-lived identity token (OIDC)
- AWS STS exchanges it for short-lived AWS credentials
- Your workflow assumes a least-privilege role and does the work
This portfolio uses the same pattern to support Cloud telemetry mode (AWS S3) without ever embedding long-lived credentials.
The architecture
\
