GitHub Actions OIDC Patterns

Core Principle: Official Actions Over Scripts

Hybrid OIDC Pattern

permissions:
  contents: read
  id-token: write  # Required for OIDC

jobs:
  deploy:
    steps:
      # 1. AWS identity via GitHub OIDC
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/github-actions
          aws-region: us-east-1

      # 2. Pulumi Cloud auth (for ESC access)
      - uses: pulumi/auth-actions@v1
        with:
          organization: myorg
          requested-token-type: urn:pulumi:token-type:access_token:organization

      # 3. Load config from ESC
      - uses: pulumi/esc-action@v1
        with:
          environment: myorg/myproject/staging

      # 4. Use config (all values from ESC now)
      - run: echo "Cluster: $ECS_CLUSTER"

AWS IAM Trust Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::ACCOUNT:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:ORG/REPO:*"
        }
      }
    }
  ]
}

Anti-Patterns