OIDC for cloud authentication (modern best practice)

Don't put long-lived AWS access keys in GitHub secrets. Use OIDC to let GitHub Actions assume an IAM role with short-lived credentials.

permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
      aws-region: eu-west-2

The IAM role trusts the GitHub OIDC provider with a condition on the repo and branch. No static credentials needed. Mention this in interviews — it signals modern security practice.