From 5bae4a9f6f529fe5de8f1e914e3285ac668fa44f Mon Sep 17 00:00:00 2001
From: JD Harrington <jd.harrington@getbridge.com>
Date: Mon, 22 Jun 2026 15:07:47 -0400
Subject: [PATCH] Replace static IAM credentials used by publish workflow

The IAM user and static credentials used by the Publish
(bootstrap-tamplates.yaml) workflow have been replaced by an IAM role
assumed via OIDC that is now managed in central-infra:

https://github.com/get-bridge/central-infra/pull/93
---
 .github/workflows/bootstrap-templates.yml | 27 +++++++-----
 .gitignore                                |  1 +
 terraform/config.tf                       | 23 ----------
 terraform/main.tf                         | 51 -----------------------
 4 files changed, 17 insertions(+), 85 deletions(-)
 delete mode 100644 terraform/config.tf
 delete mode 100644 terraform/main.tf

diff --git a/.github/workflows/bootstrap-templates.yml b/.github/workflows/bootstrap-templates.yml
index b16c989..4896dca 100644
--- a/.github/workflows/bootstrap-templates.yml
+++ b/.github/workflows/bootstrap-templates.yml
@@ -4,20 +4,25 @@ on:
     tags: ["*"]
     branches: ["bootstrapper"]
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   # The publish job will publish the bootstrap-templates directory to the correct S3 Bucket
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
-      - uses: jakejarvis/s3-sync-action@master
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
         with:
-          args: --acl private --follow-symlinks
-        env:
-          # Credentials for this workflow are provisioned in the `terraform` directory
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_S3_BUCKET: truss-cli-global-config
-          AWS_REGION: us-east-2
-          SOURCE_DIR: bootstrap-templates
-          DEST_DIR: bootstrap-templates
+          role-to-assume: arn:aws:iam::127178877223:role/github/truss-cli-github-actions
+          aws-region: us-east-2
+
+      - name: Sync to S3
+        run: |
+          aws s3 sync bootstrap-templates/ s3://truss-cli-global-config/bootstrap-templates/ \
+            --follow-symlinks \
+            --delete
diff --git a/.gitignore b/.gitignore
index 4b1d399..60bd5e3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,4 @@ dist/
 
 # vscode
 .vscode/
+terraform/.state-backup/
diff --git a/terraform/config.tf b/terraform/config.tf
deleted file mode 100644
index fbbb5f8..0000000
--- a/terraform/config.tf
+++ /dev/null
@@ -1,23 +0,0 @@
-terraform {
-  backend "s3" {
-    bucket   = "bridge-shared-terraform-us-east-2"
-    key      = "truss-cli/terraform/terraform.tfstate"
-    region   = "us-east-2"
-    acl      = "bucket-owner-full-control"
-    encrypt  = true
-    role_arn = "arn:aws:iam::127178877223:role/xacct/ops-admin"
-  }
-}
-
-provider "aws" {
-  region              = "us-east-2"
-  allowed_account_ids = ["127178877223"]
-
-  assume_role {
-    role_arn = "arn:aws:iam::127178877223:role/xacct/ops-admin"
-  }
-}
-
-provider "github" {
-  organization = "get-bridge"
-}
diff --git a/terraform/main.tf b/terraform/main.tf
deleted file mode 100644
index dd903dd..0000000
--- a/terraform/main.tf
+++ /dev/null
@@ -1,51 +0,0 @@
-// iam stuff
-// github action secret
-
-resource "aws_iam_user" "publisher" {
-  name = "truss-cli-github-actions"
-  path = "/github/"
-}
-
-resource "aws_iam_user_policy" "publisher" {
-  name = "truss-cli-github-actions-policy"
-  user = aws_iam_user.publisher.name
-
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "s3:PutObject",
-        "s3:GetObjectAcl",
-        "s3:GetObject",
-        "s3:ListBucket",
-        "s3:DeleteObject",
-        "s3:PutObjectAcl"
-      ],
-      "Resource": [
-        "arn:aws:s3:::truss-cli-global-config",
-        "arn:aws:s3:::truss-cli-global-config/*"
-      ]
-    }
-  ]
-}
-EOF
-}
-
-resource "aws_iam_access_key" "publisher" {
-  user = aws_iam_user.publisher.name
-}
-
-resource "github_actions_secret" "aws_access_key" {
-  repository      = "truss-cli"
-  secret_name     = "AWS_ACCESS_KEY_ID"
-  plaintext_value = aws_iam_access_key.publisher.id
-}
-
-resource "github_actions_secret" "aws_secret_key" {
-  repository      = "truss-cli"
-  secret_name     = "AWS_SECRET_ACCESS_KEY"
-  plaintext_value = aws_iam_access_key.publisher.secret
-}