--- title: SSH into AWS using Github for RBAC | daily.dev description: A step-by-step case study shows how to make GitHub the single source of truth for AWS and SSH access control. It walks through connecting GitHub to Auth0 via... canonical: https://daily.dev/posts/ssh-into-aws-using-github-for-rbac-wy2lvxqhb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SSH into AWS using Github for RBAC | daily.dev og:description: A step-by-step case study shows how to make GitHub the single source of truth for AWS and SSH access control. It walks through connecting GitHub to Auth0 via... og:url: https://daily.dev/posts/ssh-into-aws-using-github-for-rbac-wy2lvxqhb og:image: https://api.daily.dev/og/posts/wY2LvXQHB.png og:image:alt: SSH into AWS using Github for RBAC og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SSH into AWS using Github for RBAC **[Teleport](https://daily.dev/sources/teleport)** · 8 min read · 0 upvotes · 0 comments ## Summary A step-by-step case study shows how to make GitHub the single source of truth for AWS and SSH access control. It walks through connecting GitHub to Auth0 via SAML/OIDC, writing Auth0 rules to fetch GitHub team membership and map it to AWS IAM roles, and configuring Teleport Enterprise to translate GitHub teams into SSH roles with auto-expiring credentials, restricted OS logins, and session recording for audit purposes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I map GitHub team membership to AWS IAM roles for single sign-on? Use Auth0 as an authentication hub between GitHub and AWS via SAML 2.0. An Auth0 rule fetches the user's GitHub teams through the GitHub API, stores them in app_metadata.roles, and a second rule maps specific team names like 'org/admins' to AWS IAM role ARNs using the SAML Role and RoleSessionName attribute mappings. _daily.dev surfaces practical infrastructure guides for teams wiring GitHub identity into AWS access control._ ### How can I restrict SSH access to servers based on GitHub team membership? Configure Teleport Enterprise with an OIDC connector pointing to Auth0, requesting a 'roles' scope that returns the user's GitHub teams as a claim. Teleport's claims_to_roles setting then maps claim values such as 'example/admins' to Teleport roles like 'admin', which define allowed OS logins, node labels, and session TTLs. _Engineers designing SSH RBAC policies can track approaches like this one on daily.dev._ ### Why does the Auth0 rule for GitHub team lookup need a custom User-Agent header? The GitHub API rejects requests to the /user/teams endpoint without a User-Agent header, so the Auth0 rule sets it to match the registered GitHub OAuth application name (for example 'Auth0'). This is required alongside the token Authorization header carrying the user's GitHub access token for the request to succeed. _daily.dev helps developers debugging GitHub API integration quirks like this one stay informed._ ## Similar posts on daily.dev - [Connect GitHub Actions to AWS with OIDC \(No Access Keys\)](https://daily.dev/posts/connect-github-actions-to-aws-with-oidc-no-access-keys--d4kysoafb) · AWS Fundamentals · 0 upvotes · 0 comments - [Automate SSO authorization for classic PATs and SSH keys](https://daily.dev/posts/automate-sso-authorization-for-classic-pats-and-ssh-keys-b4pmx6xnw) · GitHub Changelog · 0 upvotes · 0 comments - [AWS Elastic Beanstalk now supports GitHub Actions for automated application deployment](https://daily.dev/posts/aws-elastic-beanstalk-now-supports-github-actions-for-automated-application-deployment-p3wzvedct) · AWS · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#authentication](https://daily.dev/tags/authentication), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/ssh-into-aws-using-github-for-rbac-wy2lvxqhb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SSH into AWS using Github for RBAC","url":"https://daily.dev/posts/ssh-into-aws-using-github-for-rbac-wy2lvxqhb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ssh-into-aws-using-github-for-rbac-wy2lvxqhb"},"datePublished":"2026-08-23T12:22:08.770Z","dateModified":"2026-08-23T12:48:34.561Z","description":"A step-by-step case study shows how to make GitHub the single source of truth for AWS and SSH access control. It walks through connecting GitHub to Auth0 via...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ssh-into-aws-using-github-for-rbac-wy2lvxqhb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,authentication,ssh","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SSH into AWS using Github for RBAC"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ssh-into-aws-using-github-for-rbac-wy2lvxqhb#faq","mainEntity":[{"@type":"Question","name":"How do I map GitHub team membership to AWS IAM roles for single sign-on?","acceptedAnswer":{"@type":"Answer","text":"Use Auth0 as an authentication hub between GitHub and AWS via SAML 2.0. An Auth0 rule fetches the user's GitHub teams through the GitHub API, stores them in app_metadata.roles, and a second rule maps specific team names like 'org/admins' to AWS IAM role ARNs using the SAML Role and RoleSessionName attribute mappings. daily.dev surfaces practical infrastructure guides for teams wiring GitHub identity into AWS access control."}},{"@type":"Question","name":"How can I restrict SSH access to servers based on GitHub team membership?","acceptedAnswer":{"@type":"Answer","text":"Configure Teleport Enterprise with an OIDC connector pointing to Auth0, requesting a 'roles' scope that returns the user's GitHub teams as a claim. Teleport's claims_to_roles setting then maps claim values such as 'example/admins' to Teleport roles like 'admin', which define allowed OS logins, node labels, and session TTLs. Engineers designing SSH RBAC policies can track approaches like this one on daily.dev."}},{"@type":"Question","name":"Why does the Auth0 rule for GitHub team lookup need a custom User-Agent header?","acceptedAnswer":{"@type":"Answer","text":"The GitHub API rejects requests to the /user/teams endpoint without a User-Agent header, so the Auth0 rule sets it to match the registered GitHub OAuth application name (for example 'Auth0'). This is required alongside the token Authorization header carrying the user's GitHub access token for the request to succeed. daily.dev helps developers debugging GitHub API integration quirks like this one stay informed."}}]} ```