It's only confusing because of the terms the industry uses to describe it. To achieve the task, i.e: a GitHub being able to update an AWS Lambda without storin

It's only confusing because of the terms the industry uses to describe it. To achieve the task, i.e: a GitHub being able to update an AWS Lambda without storing a secret/key/certificate you minimally need: 1. A way for GitHub to sign a request before calling AWS with it. 2. A way for AWS to verify this request was signed with GitHub. 3. A way to tell AWS what actions a valid GitHub request is authorized to do. #1 is very easy with a public/private key signature. For #2 OIDC standardizes this part. Every IdP publishes their public keys in a standardized way. For #3 AWS already has a full permissions/roles system, so it makes sense to use that for this. Then you can get a GitHub action to do anything an AWS account can. To string 1, 2, and 3 together you end up with the confusing flow you described.