Configure GitHub OIDC for AWS deployment

[replakcan]

Description

Configure GitHub Actions to assume an AWS IAM role using OIDC instead of storing long-lived AWS access keys.

Scope

• Create IAM OIDC provider if needed
• Create IAM role for GitHub Actions
• Configure trust policy for the repository
• Attach least-privilege permissions for S3 deploy and CloudFront invalidation
• Configure GitHub secret for role ARN

Out of Scope

• Terraform automation
• Multi-account AWS setup
• Preview environment roles

Acceptance Criteria

• GitHub Actions can assume the AWS role
• No long-lived AWS access key is required
• Role permissions are limited to required S3 and CloudFront actions
• Role ARN is stored as GitHub secret
• Deployment workflow uses the assumed role
• Trust policy is documented

Technical Notes

• Prefer least privilege.
• Restrict role assumption to this repository and main branch where possible.

Related

• Related to: Add GitHub Actions deployment workflow to S3