A company’s CI/CD pipelines in GitHub Actions currently use an IAM user’s long-lived secret key to call AWS. An existing IAM role with the required permissions exists. The security team now forbids long-lived secret keys for pipelines. Which short-lived authentication method meets the requirement with the least operational overhead?

The correct answer leverages OpenID Connect (OIDC) federation, which is the recommended and most operationally efficient way to grant GitHub Actions pipelines temporary AWS credentials. By creating an OIDC identity provider in IAM for GitHub, you establish a trust relationship. A new IAM role with a trust policy allowing sts:AssumeRoleWithWebIdentity from this OIDC IdP enables GitHub Actions to directly assume the role and obtain short-lived credentials without storing long-lived AWS keys. This eliminates the need for managing secrets in GitHub. SAML 2.0 is generally used for user authentication to the AWS Management Console, not typically for programmatic access from CI/CD pipelines, and would involve more complex configuration. Amazon Cognito is primarily for user authentication to applications and doesn't directly integrate with GitHub Actions for pipeline authentication in this manner. IAM Roles Anywhere is designed for on-premises or non-AWS environments to assume roles using X.509 certificates, which is not applicable here as GitHub Actions is a cloud-native service.