Assume role instead of using IAM keys directly

didx-xyz · Apr 23, 2023 · e3582a8 · e3582a8
1 parent 33f7397
commit e3582a8
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/aws_ecr.yml b/.github/workflows/aws_ecr.yml
@@ -30,6 +30,8 @@ concurrency:
 jobs:
   build:
     name: Build image and push to ECR
+    permissions:
+      id-token: write # This is required for requesting the JWT
     runs-on: ubuntu-latest
 
     outputs:
@@ -85,9 +87,9 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v2
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: af-south-1
+          role-to-assume: arn:aws:iam::402177810328:role/cicd
+          role-session-name: github-cicd
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2