Led the migration of GitLab CI/CD pipelines from static IAM access keys to OIDC-based federation. This eliminated long-lived credentials from the pipeline entirely — runners now assume short-lived IAM roles via OIDC trust policies. The migration included updating Terraform providers, scoping IAM policies to least privilege, and validating the trust chain across multiple AWS accounts.