Many engineers first encounter GitHub Actions OIDC as a way to remove AWS access keys from repositories. That solves one security problem, but it is only part of the story.
This lesson focuses on the identity flow behind GitHub OIDC. GitHub issues a signed identity token. AWS validates the token through an IAM OIDC provider. STS then exchanges that identity for temporary AWS credentials.
The lesson also explains a common source of confusion: authentication and authorization are separate controls. A workflow may successfully assume a role and still be denied access to AWS resources if the permission policy does not allow the operation.
The final section examines repository governance as part of the cloud security boundary. OIDC removes secret management risk, but trusted workflows still require strong repository controls, branch protection, and narrowly scoped trust policies.
If you use GitHub Actions with AWS, understanding this distinction is critical for building secure CI/CD pipelines.