feat: AWS GitHub Actions OIDC for Terraform state access

[nbrieussel]

Problem

The Terraform state backend was migrated from Scaleway Object Storage to real AWS S3 (eu-west-3, Paris — see #27). Without this, CI workflows would need static AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in GitHub secrets to reach the state bucket. AWS IAM is an OIDC relying party, so we can replace those static keys with GitHub Actions OIDC → AWS IAM role assumption — no long-lived AWS credentials in GitHub.

Scaleway IAM is not an OIDC relying party (feature request), so Scaleway resources (Kapsule, VPC) keep using the static, scoped Scaleway API key from github-ci/ / terraform-ci/. OIDC here covers only the AWS/S3 side — Scaleway OIDC remains a non-goal, blocked upstream.

Changes

• New aws-github-oidc/ root (AWS provider only; S3 backend, key aws-github-oidc/terraform.tfstate, same bucket as every other root):
  • aws_iam_openid_connect_provider.github_actions — GitHub Actions OIDC provider (one per account; import if it already exists).
  • aws_iam_role.github_actions (github-actions-terraform) — trust policy scoped to repo:IntegratedDynamic/infrastructure:* with audience sts.amazonaws.com.
  • aws_iam_role_policy.github_actions_s3 (terraform-state-s3) — least privilege: ListBucket + GetBucketVersioning on the bucket, object Get/Put/Delete on its keys (the use_lockfile = true S3-native lock rides on object R/W — no DynamoDB).
  • outputs.tf → role_arn; README.md; gitignored nico.auto.tfvars placeholder (no secrets — AWS creds come from the local AWS CLI/SSO session).
  • .terraform.lock.hcl for darwin_arm64 + linux_amd64.
• mise.toml — aws-github-oidc-{init,plan,apply} tasks; root added to lock.
• terraform-lock.yml — aws-github-oidc added to the lock matrix.

Verify

terraform -chdir=aws-github-oidc fmt -check
terraform -chdir=aws-github-oidc validate          # passes offline
mise run aws-github-oidc-plan                        # needs `aws sso login` first
actionlint .github/workflows/*.yml

fmt, validate, providers lock (both platforms) and actionlint all pass locally. terraform plan was not run here — the local AWS SSO token was expired and I won't trigger an auth flow; run mise run aws-github-oidc-plan after aws sso login and review before apply.

Post-apply manual steps (operator)

1. mise run aws-github-oidc-apply (creates the OIDC provider + role).
2. Wire the role ARN into CI as a repo variable (an ARN is a public identifier, not a secret), since it's only known after apply:

   gh variable set AWS_GITHUB_ACTIONS_ROLE_ARN \
     --repo IntegratedDynamic/infrastructure \
     --body "$(terraform -chdir=aws-github-oidc output -raw role_arn)"

   Workflows then use aws-actions/configure-aws-credentials with role-to-assume: ${{ vars.AWS_GITHUB_ACTIONS_ROLE_ARN }} and permissions: id-token: write.

Deferred — depends on the open #30 (terraform-ci/)

This branch is cut from main, where neither terraform-ci/ nor the list-state-bucket-terraform-ci job exist yet — they live in the still-open #30. To avoid cross-PR conflicts (one issue = one PR), the following are intentionally not in this PR and should land in a follow-up on top of #30 once it merges:

• Rework scaleway-auth-check.yml → list-state-bucket-terraform-ci to use OIDC instead of static TF_SCW_* AWS keys: add permissions: id-token: write, an aws-actions/configure-aws-credentials step (pinned SHA) with role-to-assume: ${{ vars.AWS_GITHUB_ACTIONS_ROLE_ARN }}, run aws s3 ls s3://id-terraform-state20260612164136440800000001, and drop the environment: scaleway gate (OIDC needs no secret environment).
• terraform-ci/main.tf cleanup — drop ObjectStorageReadWrite (state is now on AWS S3, not Scaleway), keeping only KubernetesFullAccess + VPCFullAccess.

If preferred, I can rebase this branch onto #30's branch and fold those two items in — but that stacks PRs, so I left it as a documented follow-up by default.

🤖 Generated with Claude Code