replace iam user with role

.github/workflows/bootstrap-templates.yml

@@ -4,20 +4,25 @@ on:
     tags: ["*"]
     branches: ["bootstrapper"]
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   # The publish job will publish the bootstrap-templates directory to the correct S3 Bucket
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
-      - uses: jakejarvis/s3-sync-action@master
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
         with:
-          args: --acl private --follow-symlinks
-        env:
-          # Credentials for this workflow are provisioned in the `terraform` directory
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_S3_BUCKET: truss-cli-global-config
-          AWS_REGION: us-east-2
-          SOURCE_DIR: bootstrap-templates
-          DEST_DIR: bootstrap-templates
+          role-to-assume: arn:aws:iam::127178877223:role/github/truss-cli-github-actions
+          aws-region: us-east-2
+
+      - name: Sync to S3
+        run: |
+          aws s3 sync bootstrap-templates/ s3://truss-cli-global-config/bootstrap-templates/ \
+            --follow-symlinks \
+            --delete

.gitignore

@@ -30,3 +30,4 @@ dist/
 
 # vscode
 .vscode/
+terraform/.state-backup/