switch aws creds to role-based

make-software · Jul 8, 2024 · 5a81879 · 5a81879
1 parent 81178d9
commit 5a81879
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/.github/workflows/dev-deploy.yaml b/.github/workflows/dev-deploy.yaml
@@ -5,6 +5,10 @@ on:
     branches:
       - 'master'
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   build:
     name: Build Images
@@ -26,8 +30,8 @@ jobs:
     - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
-        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.AWS_ACCESS_ROLE_DEV }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
         aws-region: ${{ secrets.AWS_REGION }}
 
     - name: Login to Amazon ECR