Secure continuous Integration with Dockerfile, Github Actions and AWS ECR

Overview Managing containerized applications efficiently is crucial for modern DevOps workflows. One of the best ways to automate Docker image deployment is by integrating GitHub Actions with AWS Elastic Container Registry (ECR). In past post, we create Github actions pipeline and deployed image on Github registry https://ghcr.io. Instead of using IAM access keys, we will use AWS OIDC authentication with GitHub Actions. This eliminates the risk of storing long-lived credentials and improves security by relying on short-lived session tokens. Why Use AWS OIDC Authentication? ✅ No hardcoded secrets – Eliminates long-lived IAM access keys ✅ Enhanced security – Uses short-lived tokens for GitHub Actions ✅ Less maintenance – No need to rotate IAM credentials manually Step 1: Create Github Repo Create a Github repo Step 2: Create an AWS IAM Role for GitHub OIDC AWS provides OIDC (OpenID Connect) integration with GitHub to authenticate your GitHub Actions workflows securely. 1.1 Create an OIDC Identity Provider in AWS Search for IAM in AWS search bar Select Identity Provider from the left sidebar Click Add Provider Select provider type as OpenID Connect Provider URL as https://token.actions.githubusercontent.com Audience as sts.amazonaws.com It should look like as shared in the below screenshot. Now, click on Add Provider at the bottom. 1.2 Create an IAM Role for GitHub Actions Now, create an IAM role with OIDC trust policy for GitHub Actions. Search for IAM service again and select Role from the sidebar. Click to Create Role Add policy (permissions) to this Role Provide name to the IAM role and Click Create Role at the bottom.

Mar 3, 2025 - 03:43

Secure continuous Integration with Dockerfile, Github Actions and AWS ECR

Overview

Managing containerized applications efficiently is crucial for modern DevOps workflows. One of the best ways to automate Docker image deployment is by integrating GitHub Actions with AWS Elastic Container Registry (ECR).

In past post, we create Github actions pipeline and deployed image on Github registry https://ghcr.io.

Instead of using IAM access keys, we will use AWS OIDC authentication with GitHub Actions. This eliminates the risk of storing long-lived credentials and improves security by relying on short-lived session tokens.

Why Use AWS OIDC Authentication?

✅ No hardcoded secrets – Eliminates long-lived IAM access keys

✅ Enhanced security – Uses short-lived tokens for GitHub Actions

✅ Less maintenance – No need to rotate IAM credentials manually

Step 1: Create Github Repo
Create a Github repo

Step 2: Create an AWS IAM Role for GitHub OIDC
AWS provides OIDC (OpenID Connect) integration with GitHub to authenticate your GitHub Actions workflows securely.

1.1 Create an OIDC Identity Provider in AWS