If you've been storing AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as GitHub Secrets to deploy to AWS, you're not alone. It's the most common approach and it's also one of the biggest security risks in a CI/CD pipeline.
Here's why: static credentials don't expire on their own. If they get leaked through a misconfigured workflow, a public fork, or a compromised reposito...