What are the current best practices and tools for securing AWS IAM roles when using GitHub Actions runners to deploy infrastructure with Terraform?
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
What are the current best practices and tools for securing AWS IAM roles when using GitHub Actions runners to deploy infrastructure with Terraform?
3 real searches · 1 real-search pass
AWS IAM GitHub Actions OIDC security best practices trust policy subject claim official documentation 2026Google ↗
OBSERVED
GitHub Actions security hardening OIDC AWS permissions pin actions commit SHA environments official docsGoogle ↗
OBSERVED
Terraform AWS GitHub Actions OIDC deployment role least privilege plan apply security HashiCorp docsGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 3 queries…
Searches and sources
ChatGPT3 real searches · gpt-6
AWS IAM GitHub Actions OIDC security best practices trust policy subject claim official documentation 2026 Google ↗
GitHub Actions security hardening OIDC AWS permissions pin actions commit SHA environments official docs Google ↗
Terraform AWS GitHub Actions OIDC deployment role least privilege plan apply security HashiCorp docs Google ↗
- aws-actions/configure-aws-credentials · github.com
- GitHub's AWS OIDC documentation · docs.github.com
- configure-aws-credentials/README.md at main · aws-actions/configure-aws-credentials · github.com
- Configuring OpenID Connect in Amazon Web Services · docs.github.com
- Use IAM roles to connect GitHub Actions to actions in AWS · aws.amazon.com
- Create a role for OpenID Connect federation (console) · docs.aws.amazon.com
- Configuring OpenID Connect in Amazon Web Services · docs.github.com
- AWS Prescriptive Guidance - Best practices for using the Terraform AWS Provider · docs.aws.amazon.com
- Provision least-privilege IAM roles by deploying a role vending machine solution · docs.aws.amazon.com
- CI/CD Pipeline Security · owasp.github.io
- StepSecurity Harden-Runner · github.com
- AWS documentation · docs.aws.amazon.com
- Official website · checkov.io
- Official website · trivy.dev
- Official website · stepsecurity.io
- Official website · openpolicyagent.org
- GitHub repository · github.com
- AWS Prescriptive Guidance for Terraform · docs.aws.amazon.com
- Secure GitHub Actions secrets with HashiCorp Vault | Well-Architected Framework · docs.hashicorp.com
- AWS — IAM security best practices · docs.aws.amazon.com
- GitHub — Security hardening for GitHub Actions · docs.github.com
Queries
3 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
AWS IAM GitHub Actions OIDC security best practices trust policy subject claim official documentation 2026 OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
GitHub Actions security hardening OIDC AWS permissions pin actions commit SHA environments official docs OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
Terraform AWS GitHub Actions OIDC deployment role least privilege plan apply security HashiCorp docs OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |