aws-github-oidc-scoped-role

To scope AWS OIDC trust to a specific GitHub Actions workflow, configure the IAM role trust policy using the job_workflow_ref pattern. This limits role assumption strictly to that single workflow file, preventing broader AWS access.

The job_workflow_ref pattern is an OIDC sub claim used in AWS IAM trust policies. It identifies the exact GitHub Actions workflow file requesting access, allowing you to tightly restrict role assumption to that specific workflow.

Prevent credential leakage in GitHub Actions OIDC by enforcing ReadOnlyAccess alongside explicit Deny patterns. This blocks data exfiltration and restricts destructive actions while securely assuming the tightly scoped AWS IAM role.

Yes, AWS Bedrock inference patterns within GitHub Actions workflows require specific AWS Marketplace permissions. You must configure these necessary permissions within your scoped IAM role to properly execute AI agent tasks.

ReadOnlyAccess for AWS OIDC roles prevents direct resource modification but cannot stop data exfiltration. You must add explicit Deny patterns to block credential leakage and secure sensitive data from unauthorized access.