How can OIDC Role be used to assume IAM Role in a Terraform backend Workflow via Github-Actions?

edit

Create an IAM role that has the necessary permissions to access the Terraform backend.

Configure the OIDC provider in your AWS account and create an OIDC provider URL.

In the IAM console, create a role that will be assumed by the Github-Actions workflow.

Assign the necessary permissions to the role, such as access to the Terraform backend.

Add the IAM role ARN and the OIDC provider URL to the Github-Actions secret values.

In your Github-Actions workflow script, use the AWS CLI to retrieve the OIDC token and assume the IAM role using the AWS Security Token Service (STS) API.

After the IAM role has been assumed, execute your Terraform commands in the Github-Actions workflow as usual.

When the workflow is complete, revoke the OIDC token and terminate the assumed IAM role in order to maintain security.