From 0fc9cae53bc3e52fecc11f470a7e56135012bc06 Mon Sep 17 00:00:00 2001
From: Belal Rashid <MohammedBelal.Rashid@cognizant.com>
Date: Wed, 23 Sep 2026 16:25:46 +0100
Subject: [PATCH] Migrate GitHub Actions deploy auth from IAM access keys to
 OIDC.

Use short-lived role assumption via DEPLOY_AWS_ROLE_ARN instead of long-lived AWS access keys.
---
 .github/workflows/deploy-to-dev.yml     | 6 ++++--
 .github/workflows/deploy-to-staging.yml | 6 ++++--
 .github/workflows/deploy.yml            | 6 ++++--
 .github/workflows/publish.yml           | 6 ++++--
 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy-to-dev.yml b/.github/workflows/deploy-to-dev.yml
index 21200b0..f3c1dd8 100644
--- a/.github/workflows/deploy-to-dev.yml
+++ b/.github/workflows/deploy-to-dev.yml
@@ -7,6 +7,9 @@ on: [workflow_dispatch]
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     env:
       DOCKER_REPO: ${{ secrets.DEPLOY_DOCKER_REPOSITORY }}
     environment: development
@@ -18,8 +21,7 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:
-          aws-access-key-id: ${{ secrets.DEPLOY_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.DEPLOY_AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.DEPLOY_AWS_ROLE_ARN }}
           aws-region: eu-west-2
 
       - uses: aws-actions/amazon-ecr-login@v2
diff --git a/.github/workflows/deploy-to-staging.yml b/.github/workflows/deploy-to-staging.yml
index 855d148..ae09895 100644
--- a/.github/workflows/deploy-to-staging.yml
+++ b/.github/workflows/deploy-to-staging.yml
@@ -58,6 +58,9 @@ jobs:
 
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     env:
       DOCKER_REPO: ${{ secrets.DEPLOY_DOCKER_REPOSITORY }}
     environment: staging
@@ -69,8 +72,7 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:
-          aws-access-key-id: ${{ secrets.DEPLOY_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.DEPLOY_AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.DEPLOY_AWS_ROLE_ARN }}
           aws-region: eu-west-2
 
       - uses: aws-actions/amazon-ecr-login@v2
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 37d4cc3..ef14181 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -80,6 +80,9 @@ jobs:
 
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     env:
       DOCKER_REPO: ${{ secrets.DEPLOY_DOCKER_REPOSITORY }}
     needs: [detect-environments]
@@ -96,8 +99,7 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:
-          aws-access-key-id: ${{ secrets.DEPLOY_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.DEPLOY_AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.DEPLOY_AWS_ROLE_ARN }}
           aws-region: eu-west-2
 
       - uses: aws-actions/amazon-ecr-login@v2
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 02384d9..66c6b67 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -35,6 +35,9 @@ jobs:
 
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     env:
       DOCKER_REPO: ${{ secrets.DEPLOY_DOCKER_REPOSITORY }}
     needs: [detect-environments]
@@ -51,8 +54,7 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v6
         with:
-          aws-access-key-id: ${{ secrets.DEPLOY_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.DEPLOY_AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: ${{ secrets.DEPLOY_AWS_ROLE_ARN }}
           aws-region: eu-west-2
 
       - uses: aws-actions/amazon-ecr-login@v2