Cloud Deployment — AWS

~12 min · aws, oidc, ecs, lambda

Level 0Apprentice

0 XP0/101 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

OIDC + a deploy action

The AWS deploy pattern is OIDC for auth, then one of:

ECS rolling deploy — aws-actions/amazon-ecs-deploy-task-definition
EKS via kubectl — aws-actions/configure-aws-credentials + aws eks update-kubeconfig + kubectl apply.
Lambda — aws-actions/aws-lambda-deploy or aws lambda update-function-code.
S3 / CloudFront static — aws s3 sync + aws cloudfront create-invalidation.
App Runner — aws-actions/amazon-app-runner-deploy.

One-time setup on AWS side

IAM Identity Provider for token.actions.githubusercontent.com.
IAM Role with trust policy keyed on repo:my-org/my-repo:ref:refs/heads/main.
Role's permissions policy allows the specific deploy action (e.g., ecs:UpdateService on the specific service ARN).

Once set up, every workflow run gets fresh, scoped, ~1-hour credentials. No static keys.

Code

Deploy a static site to S3 + CloudFront·yaml

  deploy:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    environment:
      name: production
      url: https://www.example.com
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with: { name: dist, path: dist }
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::111222333444:role/gha-deploy-prod
          aws-region: us-east-1
      - run: |
          aws s3 sync dist/ s3://www-example-com/ --delete
          aws cloudfront create-invalidation \
            --distribution-id ${{ vars.CLOUDFRONT_ID }} \
            --paths '/*'

External links

Exercise

If you have an AWS workload, set up the IAM Identity Provider + role and migrate one deploy from static keys to OIDC. The Trust Relationship JSON is the tricky part — scope it to a single repo + branch.