Technical Concepts
GitHub OIDC federation
The mechanism by which an assessment obtains short-lived credentials in your account without any stored secret existing anywhere.
What it is
An identity federation standard. A workflow requests a short-lived, signed token asserting where it is running. That token is presented to AWS, which validates it against an identity provider in your account and checks its claims against your role's trust policy.
Why it removes the credential problem entirely
There is no shared secret. Nothing is stored, so nothing can be leaked, rotated late, or found in a repository years later.
The token is minted per run, is short-lived, and asserts facts about its origin that the caller cannot forge, because GitHub signs it rather than the caller asserting it.
What your role checks
The audience, the subject, the session name pattern, and the engagement expiry. All four are conditions in your own trust policy.
The maximum session
One hour, set on the role.
What it does not mean
Federation is not a lower standard of authentication than an access key. It is a stronger one: the claims are asserted by a third party rather than by whoever holds a string.