Terraform IAM: GitHub OIDC provider and dev/prod roles

[cursor]

Parent

#105

Spec

spec/features/014-cicd-infrastructure/spec.md

What to build

Add infra/terraform/modules/iam-github-oidc/ and wire in dev/prod environments:

• GitHub OIDC identity provider for token.actions.githubusercontent.com
• Role smartwealthai-github-actions-dev: trust repo JLaborda/SmartWealthAI, branch develop, GitHub Environment dev; read/write dev S3 bucket only
• Role smartwealthai-github-actions-prod: trust repo, branch main, Environment production; read/write prod S3 bucket only

Least privilege: dev role cannot access prod bucket and vice versa.

Acceptance criteria

• OIDC provider resource created once (shared or per-environment as appropriate)
• Trust policies include sub conditions for repo, ref, and environment
• Dev role policies grant S3 access only to dev bucket ARN from storage module output
• Prod role policies grant S3 access only to prod bucket ARN
• Module outputs role_arn for use in GitHub Actions workflows

Blocked by

#106

Type

AFK