ci: move to oidc

p6m7g8 · Oct 31, 2024 · 60fb9c5 · 60fb9c5
1 parent 9310c79
commit 60fb9c5
Showing 1 changed file with 3 additions and 10 deletions.
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -32,19 +32,12 @@ jobs:
           key: ${{ runner.os }}-node-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
             ${{ runner.os }}-node-
-      # - name: Assume role using OIDC
-      #   uses: aws-actions/[email protected]
-      #   env:
-      #     AWS_REGION: ${{ secrets.CDK_DEPLOY_REGION }}
-      #   with:
-      #     role-to-assume: arn:aws:iam::346733622331:role/cdk-hnb659fds-lookup-role-346733622331-us-east-1
-      #     aws-region: $AWS_REGION
-      - name: Assume role using AWS credentials
+      - name: Assume role using OIDC
         uses: aws-actions/[email protected]
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ secrets.CDK_DEPLOY_REGION }}
+          role-to-assume: ${{ secrets.AWS_ROLE }}
+          role-session-name: ${{ secrets.AWS_SESSION_NAME }}
       - name: Run deploy
         env:
           CDK_DEPLOY_ACCOUNT: ${{ secrets.CDK_DEPLOY_ACCOUNT }}