Merge branch 'main' of github.com:projecthorus/sondehub-infra

.github/workflows/main.yml

@@ -7,20 +7,28 @@ env:
   tf_version: 'latest'
   tf_working_dir: '.'
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 jobs:
   terraform:
     environment: main
     name: 'Terraform'
     runs-on: ubuntu-latest
+    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
+    permissions:
+      id-token: write
+      contents: read
     steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-region: ap-southeast-2
+          role-to-assume: arn:aws:iam::143841941773:role/github
+          role-session-name: Terraform
       - uses: hashicorp/setup-terraform@v1
       - name: 'Checkout'
         uses: actions/checkout@master
       - name: Terraform fmt
         id: fmt
-        run: terraform fmt -check
+        run: terraform fmt
         continue-on-error: true
       - uses: EndBug/add-and-commit@v7
         with:

.github/workflows/pr.yml

@@ -12,13 +12,23 @@ jobs:
     environment: main
     name: 'Terraform'
     runs-on: ubuntu-latest
+    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
+    permissions:
+      id-token: write
+      contents: read
     steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-region: ap-southeast-2
+          role-to-assume: arn:aws:iam::143841941773:role/github
+          role-session-name: Terraform
       - uses: hashicorp/setup-terraform@v1
       - name: 'Checkout'
         uses: actions/checkout@master
       - name: Terraform fmt
         id: fmt
-        run: terraform fmt -check
+        run: terraform fmt
         continue-on-error: true
       - uses: EndBug/add-and-commit@v7
         with: