Credentials without stored secrets

Instance profiles for BYOC runners

Attach an IAM role to your runners so jobs can reach AWS resources without a long-lived access key in repository secrets.

An instance profile lets a job obtain temporary AWS credentials from the instance metadata service. No access key is stored anywhere, so there is nothing to leak or rotate.

Preferring OIDC where you can

For deployment credentials, GitHub's OIDC federation is better still: the trust policy can be scoped to a specific repository and branch, which an instance profile cannot express.

yaml

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/deploy
    aws-region: eu-central-1

Your next build could be twice as fast, at half the price

Start free. Migrating away is the same one line, and we publish that diff too.

Start building See pricing

AWS IAM permissions BYOC needsScoped to its own resources, nothing broader IMDSv2 enforcementEnabled by default, and it should be

Instance profiles for BYOC runners

Preferring OIDC where you can

Your next build could be twice as fast, at half the price

Related