Security
How do I authenticate to AWS with OIDC?
Quick answer
Configure GitHub as an OIDC provider in IAM and use aws-actions/configure-aws-credentials with a role.
The detail that matters
Scope the trust policy to your repository and branch, or any repository in your org can assume the role.
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
Are snapshot runners safe for public repositories?Only if snapshots are taken from trusted branches and never from fork pull requests.How do I generate an SBOM?Enable buildx's sbom: true output, or run syft against the built image.How do I attach build provenance?Use actions/attest-build-provenance, or buildx's provenance: true attestation.How do I pass secrets into a Docker build?Use BuildKit build secrets with --secret, never ARG or ENV.