AWS GitHub Actions OIDC — Scoped IAM Role

OIDC Provider Setup

data "tls_certificate" "github_oidc" {
  url = "https://token.actions.githubusercontent.com"
}

resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = [data.tls_certificate.github_oidc.certificates[0].sha1_fingerprint]
}

One provider per AWS account. If it already exists, use a data source instead.

Scope: sub (repo+branch) vs job_workflow_ref (specific workflow file)