Odis Harkins oharkins

Creating the Pipeline Execution Role

To deploy your Hugo site to AWS S3 using GitHub Actions OIDC, you’ll need to set up a specific IAM role. Here’s a step-by-step guide to creating and configuring this role.

Step 1: Configure the OIDC Provider

First, you need to create an OIDC provider in AWS IAM if you haven’t already:

1. Navigate to the AWS IAM Console
2. Go to Identity Providers
3. Click “Add Provider”
4. Select “OpenID Connect”
5. For the Provider URL, enter: https://token.actions.githubusercontent.com
6. For the Audience, enter: sts.amazonaws.com
7. Click “Add provider”

Step 2: Create the IAM Role

1. Go to IAM Roles in the AWS Console
2. Click “Create Role”
3. Select “Web Identity”
4. Choose the GitHub OIDC provider you just created
5. For the Audience, select sts.amazonaws.com
6. Add the following trust relationship:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<YOUR-AWS-ACCOUNT-ID>:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
                },
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:<GITHUB-USERNAME>/<REPOSITORY-NAME>:*"
                }
            }
        }
    ]
}

Replace: