Hi,

A small startup team asked me to look at their pipeline before a security review.

Their deploys worked fine. Every day, GitHub Actions built the app and pushed it to AWS.

Then I opened the repository secrets, and there it was: an AWS access key. Someone had created it when they set up CI, pasted it in, and nobody had touched it since. Nobody could say when it was last rotated. And it could do far more than the deploy needed.

That's the setup I see most often. It works right up until the key leaks.

Here's the thing: your pipeline doesn't need a stored key at all.

With OIDC, GitHub proves to AWS which repository and branch is asking. AWS hands back credentials that expire within the hour. Nothing is saved anywhere, so there's nothing to leak.

The fix took one day:

• GitHub added as an identity provider in AWS
• a deploy role that can only do what the deploy needs
• that role locked to one repository and one branch
• the old key deleted, from GitHub and from AWS

That last step is the one people skip. If the old key still exists, you've added a second door, not closed the first.

Stored keys leak. Borrowed credentials expire.

Deploys ran just as fast as before, and the security review passed.

So here's a 30-second test for your own pipeline: open your repository secrets. If you see AWS_ACCESS_KEY_ID, ask who created it and when it was last rotated. If nobody knows, you know what to fix next.

The full walkthrough, Terraform included, is here: Deploy to AWS from GitHub Actions without access keys

Ship safely,
Umar

P.S. Not sure how your pipeline gets into AWS? Hit reply and tell me, or grab a Free AWS Review and I'll take a look.