In this part you'll have a job ask GitHub for an ID token, and print what it says. The call you'll cover: call 4, job → GitHub: the job asks for an ID token. The token says which repository and branch the job runs for, signed by GitHub. It allows nothing by itself: Part 4 shows it to AWS, which decides what to grant. …

In this part you'll let the pipeline log in to AWS with its ID token. The call you'll cover: call 5, job → AWS STS: the job trades the ID token for AWS credentials. What it adds: AWS is set up once to trust GitHub's tokens for your repository's main branch. No AWS secret is stored in GitHub: each run gets credentials …

In these labs we connect GitHub Actions to other services: allow GitHub Actions to push images to Docker Hub; allow GitHub Actions to log in to AWS; allow GitHub Actions to deploy to an EKS cluster; allow the EKS cluster to pull images from Docker Hub; allow GitHub Actions to post to Slack. New to GitHub Actions? Start …