switch aws creds to role-based

make-software · Jul 8, 2024 · 6a8514d · 6a8514d
1 parent 67964a5
commit 6a8514d
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/.github/workflows/dev-build.yaml b/.github/workflows/dev-build.yaml
@@ -7,6 +7,10 @@ on:
     paths-ignore:
       - '.github/**'
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   build:
     name: Build Image
@@ -19,8 +23,8 @@ jobs:
     - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
-        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.AWS_ACCESS_ROLE_DEV }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
         aws-region: ${{ secrets.AWS_REGION }}
 
     - name: Login to Amazon ECR