5.1 Objective

Build a GitHub Actions workflow that automatically deploys the static site to AWS S3 on every push to main. Chose AWS S3 over Netlify to stay fully within the AWS ecosystem and build transferable DevOps skills (IAM, S3, OIDC federation).

5.2 Decision: S3 over Netlify

Netlify was the simpler default, but S3 was chosen deliberately: it gives hands-on experience with IAM, bucket policies, and CI-to-cloud authentication, and sets up the later custom domain (Day 18-20) and log monitoring (Day 21-22) tasks to build naturally on CloudFront and S3 access logs.

5.3 Infrastructure Setup

S3 Bucket

• Created bucket with static website hosting enabled
• Index document: index.html
• Bucket policy set for public read access (acceptable for a learning project; production setups would front this with CloudFront + Origin Access Control instead)

Authentication: OIDC (not access keys)

Initially scoped with long-lived IAM user access keys, then deliberately switched to OpenID Connect (OIDC) federation - GitHub Actions assumes a short-lived AWS role per run instead of storing static secrets. This is the safer, more current best practice and avoids key rotation entirely.

• Registered token.actions.githubusercontent.com as an OIDC Identity Provider in IAM
• Created an IAM Role (github-actions-s3-deploy) with a trust policy scoped to this specific repo and branch
• Attached a least-privilege permissions policy: s3:PutObject, s3:DeleteObject, s3:ListBucket, scoped only to the project bucket
• Deleted the original IAM user (github-actions-deployer) and its access keys once OIDC was confirmed working

5.4 Trust Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Principal": {
                "Federated": "arn:aws:iam::<ACCOUNT_ID>:oidc-
provider/token.actions.githubusercontent.com"
            },
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": ["sts.amazonaws.com"]
                },
                "StringLike": {

                    "token.actions.githubusercontent.com:sub": [
                        "repo:qezman/cicd-static-site:ref:refs/heads/main"
                    ]
                }
            }
        }
    ]
}

Last activity
O.1 hour ago
Maximum session duration
1 hour

Entities that can assume this role under specified conditions.