Create Access key and Secret key

In this section, you will generate AWS credentials and configure GitHub Actions repository secrets. These secrets allow your GitHub Actions deployment pipelines to securely authenticate with Amazon ECR, publish container images, register updated Amazon ECS task definitions, and trigger zero-downtime rolling service updates.

Step 1: Create an IAM access key in AWS

To allow an external runner like GitHub Actions to execute deployment commands against your AWS environment, you must provide programmatic access credentials.

  1. Log in to the AWS Management Console.

  2. In the top-right navigation bar, click your account name or ID dropdown menu and select Security credentials.

    AWS console navigation to security credentials

  3. Scroll down to the Access keys section and click Create access key.

    Create access key button in IAM

  4. In the Access key best practices & alternatives step, select the Third-party service use case option.

  5. Check the confirmation checkbox acknowledging AWS recommendations, then click Next.

    Select third-party service use case

  6. (Optional) In the Description tag value field, enter Access key for GitHub Actions.

  7. Click Create access key.

    Set description tag for access key

  8. In the Retrieve access keys step, your new credential pair is generated:

    • Access key
    • Secret access key

  9. Click Download .csv file to save a copy locally, or copy both values to a secure location.

    Retrieve access keys and download CSV file

  10. Click Done. Your new access key now appears in the active credentials list.

    Active access keys list in IAM console

This is the only time the secret access key can be viewed or downloaded from the AWS console. If you navigate away without saving it, AWS cannot recover the value, and you will need to deactivate the key pair and generate a new one. Never commit access keys to public repositories or unencrypted scripts.

Step 2: Configure repository secrets in GitHub

GitHub Actions uses encrypted repository secrets to inject credentials and infrastructure identifiers into CI/CD workflows at runtime without exposing them in plaintext code.

  1. In your web browser, navigate to your aws-fcaj-container-app repository on GitHub.

  2. Click the Settings tab in the top repository navigation bar.

    GitHub repository settings tab

  3. In the left navigation menu, expand Secrets and variables and select Actions.

  4. In the Repository secrets section, click New repository secret.

  5. Add each of the following 11 secrets by entering the exact secret name and its corresponding value:

Secret NameDescriptionExample / Target Value
AWS_ACCESS_KEY_IDIAM programmatic access key IDAKIA... (from downloaded CSV)
AWS_SECRET_ACCESS_KEYIAM programmatic secret access keywJalr... (from downloaded CSV)
AWS_ACCOUNT_NUMBER12-digit AWS account ID without hyphens123456789012
AWS_REGIONAWS Region where lab resources resideus-east-1 (or your active lab region)
CLUSTER_NAMETarget Amazon ECS cluster nameFCAJ-Lab-cluster
SERVICE_NAME_FEAmazon ECS service name for frontendapp-frontend
SERVICE_NAME_BEAmazon ECS service name for backendapp-backend
TASK_NAME_FEAmazon ECS task definition family for frontendFCAJResbar-task-fe
TASK_NAME_BEAmazon ECS task definition family for backendFCAJResbar-task-be
CI_PROJECT_FE_NAMEAmazon ECR repository name for frontendaws-fcaj-container-app-frontend
CI_PROJECT_BE_NAMEAmazon ECR repository name for backendaws-fcaj-container-app-backend

Configured repository secrets in GitHub Actions

To quickly retrieve your 12-digit AWS account ID from your EC2 build instance terminal, run: aws sts get-caller-identity --query "Account" --output text