Route53 as a Key Value Store, 2026 Edition

Sat, 18 Apr 2026 00:00:00 +0000

Five Years Later 🔗

Back in 2021 I wrote about using Route53 Private Hosted Zone TXT records as a key-value store for GitHub Actions . The trick is still good in 2026 — Route53 is cheap, durable, globally replicated, and you almost certainly already have an AWS account. I still use it.

But the implementation in that post has aged badly. Two things in particular:

It authenticates with long-lived AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY repo secrets. In 2026, that’s malpractice. GitHub OIDC for AWS shipped in late 2021 — a few weeks after the original post — and there’s no good reason to keep static AWS keys in a GitHub repo anymore.
The Get action ends with echo "::set-output name=value::$VALUE". That workflow command was deprecated in October 2022 and disabled by default in 2023. The original Get action no longer works on a current ubuntu-latest runner. Embarrassing, but here we are.

There are a few smaller polish items too — fragile quote-stripping with tr, a payload.json file written to disk, no escaping if your value happens to contain a ". Let’s fix all of it.

Oidc on doug.sh

Route53 as a Key Value Store, 2026 Edition

Five Years Later 🔗