medium10 pts · first answer countsci-cddevsecops

Cloud credentials in CI

Your GitHub Actions workflow deploys to AWS. What is the most secure way to give it access?

A.Store an IAM user access key in the repository README for easy rotation.B.Hard-code the access key in the workflow YAML but make the repo private.C.Use OpenID Connect (OIDC) so the job assumes an IAM role with short-lived credentials, scoped by repo and branch in the trust policy.D.Give the runner an IAM user with AdministratorAccess stored as a repository secret that never expires.

← Deciding to promote a canary Choosing a CI cache key →