Automate deployments across multiple AWS accounts using GitHub Actions, OIDC, and the AWS Cloud Development Kit (CDK) — no long-lived AWS credentials stored in GitHub.
The overview of the solution is shown below.
[
]
A GitHub Actions workflow authenticates to AWS using OpenID Connect (OIDC) and assumes a role in a dedicated orchestration account. That role then assumes a second role in the target account, and uses those temporary credentials to run cdk deploy.
Using a separate orchestration account isn't strictly required, but it's the recommended pattern — it keeps your GitHub OIDC trust relationship in one place and lets you deploy to any number of target accounts from there.
Please https://devbuildit.com/2026/07/06/aws-orchestration-with-cdk-and-github/ for details.