The default way to let a CI pipeline deploy to AWS is to create an IAM user, generate an access key pair, and paste it into the repository secrets. It works immediately, which is exactly the problem: those credentials are long-lived, they sit in a system that many people can configure, and nothing about them expires when someone leaves the team.

OIDC federation replaces that with something better. GitHub Actions presents a signed identity token describing the workflow that is running — which repository, which branch, which environment — and AWS exchanges it for temporary credentials scoped to a role you control. No secret is ever stored, and the trust policy can refuse a token that comes from the wrong branch.

Here I walk through the mechanism end to end: the identity provider registration, the trust policy conditions that actually matter, and how the deployment role to ECS should be scoped so that a compromised workflow cannot do more than deploy.