From 393c34c25de9966abd345f3111b981f480b29a2e Mon Sep 17 00:00:00 2001 From: JD Harrington Date: Thu, 27 Aug 2026 12:44:26 -0400 Subject: [PATCH] Replace static AWS credentials with OIDC role assumption Migrate GitHub Actions workflows from static IAM credentials (TRUSS_AWS_ACCESS_KEY_ID / TRUSS_AWS_SECRET_ACCESS_KEY) to OIDC role assumption via aws-actions/configure-aws-credentials. This is part of an org-wide migration to eliminate static AWS credential usage in CI/CD pipelines (PIER-821). Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/upload.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/upload.yml b/.github/workflows/upload.yml index 83c7643..4905601 100644 --- a/.github/workflows/upload.yml +++ b/.github/workflows/upload.yml @@ -4,6 +4,10 @@ on: [push] env: ECR_REPOSITORY: toolbox +permissions: + contents: read + id-token: write + jobs: upload-docker-image: runs-on: ubuntu-latest @@ -14,8 +18,7 @@ jobs: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v4 with: - aws-access-key-id: ${{ secrets.TRUSS_AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.TRUSS_AWS_SECRET_ACCESS_KEY }} + role-to-assume: arn:aws:iam::127178877223:role/github/github-truss aws-region: us-east-2 - name: Login to AWS ECR