Use assume role

[Andrew-Chen-Wang]

Much easier, more secure

    - name: Configure AWS credentials
      # Visit https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
      # to learn how to set this up
      uses: aws-actions/configure-aws-credentials@v1
      with:
        role-to-assume: arn:aws:iam::1234567890:role/role-name
        aws-region: us-east-1

To make it work properly:

• Error: Not authorized to perform sts:AssumeRoleWithWebIdentity aws-actions/configure-aws-credentials#318

• Update AWS Policy example to make OIDC to work github/docs#18550

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::1234567890:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
                    "token.actions.githubusercontent.com:iss": "https://token.actions.githubusercontent.com"
                    "token.actions.githubusercontent.com:sub": "repo:Org-Case-Sensitive/rEpo:ref:refs/heads/main"
                }
            }
        }
    ]
}

[Andrew-Chen-Wang]

for multiple sub, you can make an array. Additional note is that you need:

permissions:
  id-token: write
  contents: read

in your job or top level of workflow