Add github token permission for OIDC

Signed-off-by: Alan Sherman <[email protected]>
communitybridge · May 1, 2024 · f7d8fed · f7d8fed
1 parent 7c33753
commit f7d8fed
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 0 deletions.
diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
@@ -8,6 +8,11 @@ on:
     branches:
       - main
 
+permissions:
+  # These permissions are needed to interact with GitHub's OIDC Token endpoint to fetch/set the AWS deployment credentials.
+  id-token: write
+  contents: read
+
 env:
   AWS_REGION: us-east-1
   AWS_PROFILE: lf-cla

diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml
@@ -10,6 +10,11 @@ on:
       - v1.*
       - v2.*
 
+permissions:
+  # These permissions are needed to interact with GitHub's OIDC Token endpoint to fetch/set the AWS deployment credentials.
+  id-token: write
+  contents: read
+
 env:
   AWS_REGION: us-east-1
   AWS_PROFILE: lf-cla

diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
@@ -10,6 +10,11 @@ on:
       - v1.*
       - v2.*
 
+permissions:
+  # These permissions are needed to interact with GitHub's OIDC Token endpoint to fetch/set the AWS deployment credentials.
+  id-token: write
+  contents: read
+
 env:
   AWS_REGION: us-east-1
   AWS_PROFILE: lf-cla