I built a 3-tier application running on Amazon EKS, deployed by a GitHub Actions pipeline that runs on every merge to main. The first version of that pipeline had two secrets sitting in the repo settings: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
Github- https://github.com/itzmayank01/3-tier-user-platform-devops
They worked. They were also a bad idea, and getting rid of them taught me more about EKS authentication than anything else in the project.
This post is the setup I ended up with. It includes the part that broke for me and that most tutorials skip: getting past IAM is only half the job, because EKS has its own authorization layer on top.
Why long-lived keys are a problem
