Modern GitOps: Secure AWS Deployments with GitHub OIDC, Two-Repository Architecture, and Native S3…
📰 Medium · DevOps
Learn how to secure AWS deployments using GitHub OIDC, two-repository architecture, and native S3 for modern GitOps
Action Steps
- Configure GitHub OIDC for secure authentication
- Implement a two-repository architecture for infrastructure and application code
- Use native S3 for state locking in Terraform
- Set up a GitOps CI/CD workflow with automated PR comments
- Apply IAM policies for native S3 locking
Who Needs to Know This
DevOps engineers and cloud architects can benefit from this article to improve the security and efficiency of their AWS deployments
Key Insight
💡 Using GitHub OIDC and native S3 can improve the security and efficiency of AWS deployments
Share This
🚀 Secure your AWS deployments with modern GitOps! Learn how to use GitHub OIDC, two-repository architecture, and native S3 🚀
Key Takeaways
Learn how to secure AWS deployments using GitHub OIDC, two-repository architecture, and native S3 for modern GitOps
Full Article
Title: Modern GitOps: Secure AWS Deployments with GitHub OIDC, Two-Repository Architecture, and Native S3…
URL Source: https://chamika31.medium.com/modern-gitops-secure-aws-deployments-with-github-oidc-two-repository-architecture-and-native-s3-c0967c95dce7?source=rss------devops-5
Published Time: 2026-07-10T07:48:54Z
Markdown Content:
[Sitemap](https://chamika31.medium.com/sitemap/sitemap.xml)
[Open in app](https://play.google.com/store/apps/details?id=com.medium.reader&referrer=utm_source%3DmobileNavBar&source=post_page---top_nav_layout_nav-----------------------------------------)
Sign up
[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fchamika31.medium.com%2Fmodern-gitops-secure-aws-deployments-with-github-oidc-two-repository-architecture-and-native-s3-c0967c95dce7&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)
[](https://medium.com/?source=post_page---top_nav_layout_nav-----------------------------------------)
Get app
[Write](https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav------------------)
[Search](https://medium.com/search?source=post_page---top_nav_layout_nav-----------------------------------------)
Sign up
[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fchamika31.medium.com%2Fmodern-gitops-secure-aws-deployments-with-github-oidc-two-repository-architecture-and-native-s3-c0967c95dce7&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)
1. [Part 1: The Two-Repository Architecture](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#741d "Part 1: The Two-Repository Architecture")
1. [1. The Bootstrap Repository (infra-bootstrap)](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#64b9 "1. The Bootstrap Repository (infra-bootstrap)")
2. [2. The Application Infrastructure Repository (app-infrastructure)](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#b785 "2. The Application Infrastructure Repository (app-infrastructure)")
2. [Part 2: State Locking in Terraform 1.10+](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#4c20 "Part 2: State Locking in Terraform 1.10+")
1. [What is State Locking and Why Do We Need It?](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#f36b "What is State Locking and Why Do We Need It?")
2. [The Old Way: S3 + DynamoDB](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#f7c9 "The Old Way: S3 + DynamoDB")
3. [The Modern Way: Native S3 Lockfile](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#527c "The Modern Way: Native S3 Lockfile")
4. [The Native S3 Locking IAM Gotcha](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#1565 "The Native S3 Locking IAM Gotcha")
3. [Part 3: Secure Authentication via AWS OIDC](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#7610 "Part 3: Secure Authentication via AWS OIDC")
4. [Part 4: GitOps CI/CD Workflow with Automated PR Comments](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#5625 "Part 4: GitOps CI/CD Workflow with Automated PR Comments")
1. [Source Codes](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#aca2 "Source Codes")
5. [Conclusion](https://chamika31.medium.com/?
URL Source: https://chamika31.medium.com/modern-gitops-secure-aws-deployments-with-github-oidc-two-repository-architecture-and-native-s3-c0967c95dce7?source=rss------devops-5
Published Time: 2026-07-10T07:48:54Z
Markdown Content:
[Sitemap](https://chamika31.medium.com/sitemap/sitemap.xml)
[Open in app](https://play.google.com/store/apps/details?id=com.medium.reader&referrer=utm_source%3DmobileNavBar&source=post_page---top_nav_layout_nav-----------------------------------------)
Sign up
[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fchamika31.medium.com%2Fmodern-gitops-secure-aws-deployments-with-github-oidc-two-repository-architecture-and-native-s3-c0967c95dce7&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)
[](https://medium.com/?source=post_page---top_nav_layout_nav-----------------------------------------)
Get app
[Write](https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav------------------)
[Search](https://medium.com/search?source=post_page---top_nav_layout_nav-----------------------------------------)
Sign up
[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fchamika31.medium.com%2Fmodern-gitops-secure-aws-deployments-with-github-oidc-two-repository-architecture-and-native-s3-c0967c95dce7&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)
1. [Part 1: The Two-Repository Architecture](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#741d "Part 1: The Two-Repository Architecture")
1. [1. The Bootstrap Repository (infra-bootstrap)](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#64b9 "1. The Bootstrap Repository (infra-bootstrap)")
2. [2. The Application Infrastructure Repository (app-infrastructure)](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#b785 "2. The Application Infrastructure Repository (app-infrastructure)")
2. [Part 2: State Locking in Terraform 1.10+](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#4c20 "Part 2: State Locking in Terraform 1.10+")
1. [What is State Locking and Why Do We Need It?](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#f36b "What is State Locking and Why Do We Need It?")
2. [The Old Way: S3 + DynamoDB](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#f7c9 "The Old Way: S3 + DynamoDB")
3. [The Modern Way: Native S3 Lockfile](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#527c "The Modern Way: Native S3 Lockfile")
4. [The Native S3 Locking IAM Gotcha](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#1565 "The Native S3 Locking IAM Gotcha")
3. [Part 3: Secure Authentication via AWS OIDC](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#7610 "Part 3: Secure Authentication via AWS OIDC")
4. [Part 4: GitOps CI/CD Workflow with Automated PR Comments](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#5625 "Part 4: GitOps CI/CD Workflow with Automated PR Comments")
1. [Source Codes](https://chamika31.medium.com/?source=post_page-----c0967c95dce7---------------------------------------#aca2 "Source Codes")
5. [Conclusion](https://chamika31.medium.com/?
DeepCamp AI