GitHub Actions OIDC 与 AWS ECR 无密钥推送实践

IAM 信任策略（示例）：{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" }, "StringLike": { "token.actions.githubusercontent.com:sub": "repo:ORG/REPO:*" } } } ] } GitHub Actions 工作流：name: build-and-push on: push: branches: ["main"] permissions: id-token: write contents: read jobs: push: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsECR aws-region: us-east-1 - uses: aws-actions/amazon-ecr-login@v2 - run: | ACCOUNT=$(aws sts get-caller-identity --query Account --output text) IMAGE="$ACCOUNT.dkr.ecr.us-east-1.amazonaws.com/app" docker build -t "$IMAGE:latest" . docker push "$IMAGE:latest"