Why should we use OpenID Connect (OIDC) integration for cloud auth instead of storing static AWS credentials?

Storing long-lived AWS IAM access keys in GitHub Secrets poses a significant security risk if the credentials are leaked. OIDC establishes a trust relationship between GitHub and your cloud provider (e.g., AWS IAM). The workflow requests a short-lived, single-use JWT token from GitHub's OIDC provider. AWS validates the token signature and returns temporary credentials (valid for e.g., 1 hour) using sts:AssumeRoleWithWebIdentity, eliminating the need to store static cloud credentials in GitHub.