Authenticate the Terraform workflows with OIDC

.github/workflows/terraform-apply.yaml

@@ -15,6 +15,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     permissions:
+      id-token: write
       contents: read
       pull-requests: write
 
@@ -24,9 +25,9 @@ jobs:
     - name: Configure AWS Credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
-        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        aws-region: us-west-2 
+        role-to-assume: arn:aws:iam::035866691871:role/devops-security-tf-apply
+        role-session-name: devopssecuritytfapply
+        aws-region: us-west-2
 
     - name: Terraform Apply
       uses: dflook/terraform-apply@v1

.github/workflows/terraform-plan.yaml

@@ -15,6 +15,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     permissions:
+      id-token: write
       contents: read
       pull-requests: write
 
@@ -24,9 +25,9 @@ jobs:
     - name: Configure AWS Credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
-        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        aws-region: us-west-2 
+        role-to-assume: arn:aws:iam::035866691871:role/devops-security-tf-plan
+        role-session-name: devopssecuritytfplan
+        aws-region: us-west-2
 
     - name: Terraform Plan
       uses: dflook/terraform-plan@v1

terraform/aws-gha-oidc-providers.tf

@@ -1,3 +1,18 @@
+// This file declares the OIDC roles used by hackforla/incubator CI. The two
+// roles used by THIS repo's CI -- devops-security-tf-plan and
+// devops-security-tf-apply -- are deliberately NOT here. They were created by
+// hand in account 035866691871 on 2026-09-05 and are tagged managed-by=exempt,
+// which is what keeps them out of the AWS/Terraform coverage report rather than
+// showing up as unmanaged.
+//
+// The reason is a bootstrap problem, not an oversight. The workflow that would
+// run the Terraform creating these roles is the same workflow that has to assume
+// them to authenticate, so they cannot exist before the first run that needs
+// them. Declaring them here would reintroduce that circularity. See
+// hackforla/devops-security#182.
+//
+// Do not "fix" their absence by adding them below.
+
 module "iam_oidc_gha_incubator" {
   source = "./modules/aws-gha-oidc-providers"