Project: infra-stack · Branch: feat/oidc-deploy · Mode: default · Model: gpt-5

Summary

Replaced long-lived AWS keys in CI with GitHub Actions OIDC: an IAM role trusted only for this repo's main branch and environment, scoped to the deploy bucket and the EKS cluster.

Conversation

Turn 1 — User

Get rid of the AWS access keys in our GitHub secrets.

Turn 1 — Assistant

Create an OIDC provider and a role whose trust policy pins repo:<org>/infra-stack:environment:prod. The workflow uses aws-actions/configure-aws-credentials with role-to-assume.

Tools used in this turn:

- Write: iam/github-oidc.tf
- Edit: .github/workflows/deploy.yml
- Bash: terraform apply -target=module.github_oidc — 3 added

Connections

- infra-stack
- GitHubActions
- OIDC
- LeastPrivilege