OPSEXP-3146 Use OIDC role to auth to aws 🛂

.github/actions/molecule_integration_ec2/action.yml

@@ -15,11 +15,8 @@ inputs:
   nexus_password:
     description: 'Nexus password passed from secrets'
     required: true
-  aws_access_key_id:
-    description: 'AWS access key id passed from secrets'
-    required: true
-  aws_secret_access_key:
-    description: 'AWS secret access key passed from secrets'
+  aws_region:
+    description: 'AWS region to use'
     required: true
   pat:
     description: 'Github token passed from secrets'
@@ -64,13 +61,19 @@ runs:
         echo "NEXUS_USERNAME=${{ inputs.nexus_username }}" >> $GITHUB_ENV
         echo "NEXUS_PASSWORD=${{ inputs.nexus_password }}" >> $GITHUB_ENV
 
+    - name: Login to AWS
+      uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
+      with:
+        aws-region: ${{ inputs.aws_region }}
+        role-to-assume: arn:aws:iam::372466110691:role/AlfrescoCI/alfresco-cloud-deploy
+        role-session-name: ${{ github.event.repository.name }}-${{ github.run_id }}
+        role-duration-seconds: 5400
+
     - name: Run tests
       shell: bash
       env:
         MOLECULE_IT_SCENARIO: ${{ inputs.matrix_name }}
         MOLECULE_IT_CONFIG: ${{ inputs.matrix_vars }}
-        AWS_ACCESS_KEY_ID: ${{ inputs.aws_access_key_id }}
-        AWS_SECRET_ACCESS_KEY: ${{ inputs.aws_secret_access_key }}
         CLONE_GITHUB_TOKEN: ${{ inputs.pat }}
       run: ./tests/molecule_it/script.sh verify
 
@@ -79,8 +82,6 @@ runs:
       env:
         MOLECULE_IT_SCENARIO: ${{ inputs.matrix_name }}
         MOLECULE_IT_CONFIG: ${{ inputs.matrix_vars }}
-        AWS_ACCESS_KEY_ID: ${{ inputs.aws_access_key_id }}
-        AWS_SECRET_ACCESS_KEY: ${{ inputs.aws_secret_access_key }}
       uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
       with:
         timeout_minutes: 30

.github/workflows/enteprise.yml

@@ -30,6 +30,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: false
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   requirements:
     name: Ensure requirements are met
@@ -220,6 +224,5 @@ jobs:
           matrix_desc: ${{ matrix.molecule_scenario.desc }}
           nexus_username: ${{ secrets.NEXUS_USERNAME }}
           nexus_password: ${{ secrets.NEXUS_PASSWORD }}
-          aws_access_key_id: ${{ secrets.aws_access_key_id }}
-          aws_secret_access_key: ${{ secrets.aws_secret_access_key }}
+          aws_region: ${{ env.AWS_REGION }}
           pat: ${{ secrets.BOT_GITHUB_TOKEN }}