update CD to use OIDC with iam role (#142)

* update CD to use OIDC with iam role * add permissions to read oidc jwt id token
rsksmart · May 8, 2024 · ed655dd · ed655dd
1 parent f546495
commit ed655dd
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
@@ -18,17 +18,19 @@ jobs:
   deploy:
     name: Deploy
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - name: Checkout
         uses: actions/checkout@v2
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
+          role-to-assume: ${{ secrets.ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
 
       - name: Login to Amazon ECR
         id: login-ecr