GitHub Actions

A scheduled plan, an exit code with three meanings, and enough deduplication to keep drift alerts useful.

Build Workload Identity Federation with Terraform and let GitHub Actions impersonate a service account safely.

Use Terraform and OIDC to exchange short-lived workflow tokens for narrowly scoped AWS credentials.