GitHub OIDC → AWS IAM Role #67

Priority: High
Difficulty: High

Description:
Set up GitHub Actions OIDC trust with AWS by configuring trust for token.actions.githubusercontent.com.

• Create an IAM role (gha-deploy-role) with minimum privileges required for: Lambda, API Gateway v2, CloudFront (invalidation), S3 (sync), and CloudWatch Logs.
• Ensure workflows can assume this role and receive temporary credentials without storing AWS keys in GitHub Secrets.

Acceptance Criteria:

• OIDC trust is established between GitHub Actions and AWS
• gha-deploy-role is created with least privilege access for required AWS services
• GitHub Actions workflow can obtain temporary AWS credentials and deploy without static keys