Breaking Authentication from GitHub to AWS

GitHub Actions OIDC is a great way to authenticate to AWS without storing long-lived credentials. But what happens when multiple workflows share the same repository and trust boundary?

This lightning talk explores how insufficiently scoped OIDC trust can allow a less-trusted GitHub workflow to potentially obtain the same AWS identity as a trusted deployment workflow. We’ll look at the GitHub → AWS authentication flow, the claims available for trust decisions, and how this differs across cloud providers.

Finally, we’ll look at practical ways to reduce the attack surface—from separating release workflows and repositories to tighter OIDC policies and runtime monitoring.