Update generalized-deployments.yaml to use IAM Role (#2196)

brave-intl · Nov 28, 2023 · 2e4988e · 2e4988e
1 parent ba7a1ef
commit 2e4988e
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/.github/workflows/generalized-deployments.yaml b/.github/workflows/generalized-deployments.yaml
@@ -10,14 +10,16 @@ jobs:
   push:
     name: Invoke General Docker Build Pipeline
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v2
+      uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
       with:
-        aws-access-key-id: ${{ secrets.GDBP_AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.GDBP_AWS_SECRET_ACCESS_KEY }}
+        role-to-assume: ${{ secrets.GDBP_AWS_IAM_ROLE_ARN }}
         aws-region: us-west-2
     - name: Override GITHUB_REF and thus ECR destination for master
       run: echo "GITHUB_REF_OVERRIDE=refs/heads/dev" >> $GITHUB_ENV