use oidc role

Author: niraj8

.github/workflows/infra-apply.yml

@@ -11,7 +11,6 @@ on:
 env:
   TF_STATE_BUCKET: "stackgen-meetup-terraform-state"
   AWS_REGION: "us-west-2"
-  STATIC_ASSETS_BUCKET: "stackgen-meetup-static-assets"
 
 jobs:
   apply-appstack:
@@ -27,15 +26,15 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
+          # aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          # aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
           aws-region: ${{ env.AWS_REGION }}
+          role-to-assume: arn:aws:iam::222634395437:role/sep-24-meetup-oidc-github
 
       - name: Apply TF Changes
         uses: ./.github/workflows/apply
         with:
           tf_state_bucket: ${{ env.TF_STATE_BUCKET }}
           tf_state_key: ${{ github.repository }}/terraform.tfstate
           aws_region: ${{ env.AWS_REGION }}
-          static_assets_bucket: ${{ env.STATIC_ASSETS_BUCKET }}

.github/workflows/infra-pr.yaml

@@ -14,6 +14,10 @@ env:
 
 jobs:
   plan:
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write 
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -25,10 +29,11 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
+          # aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          # aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
           aws-region: ${{ env.AWS_REGION }}
+          role-to-assume: arn:aws:iam::222634395437:role/sep-24-meetup-oidc-github
 
       - name: Create backend.tf
         run: |