# Set up GitHub OIDC

Set up GitHub OIDC to let GitHub Actions assume AWS roles for CI/CD without long-lived credentials. Configured via the `iam` package.

## Step 1: Add and configure the `iam` package

```bash title="repo-iac/environments/dev/"
ok pkg add iam
```

In `package-config.yml`, enable `GithubIdentityProvider`:

```yaml title="iam/package-config.yml"
StackName: "iam"
GithubIdentityProvider:
  Enable: true
```

<!-- prettier-ignore-start -->
!!! Warning "Only one per account"
    You can only have one **GithubIdentityProvider** enabled per account. If already enabled in a different environment, you cannot enable it here.

    Enabling it will cause an error when applying the stack.
<!-- prettier-ignore-end -->

## Step 2: Install and apply the package

```bash title="iam/"
ok pkg install
terraform init
terraform apply
```

## Step 3: Verify

=== "AWS CLI"

    ```bash
    aws iam list-open-id-connect-providers | jq '.OpenIDConnectProviderList[].Arn'
    ```

    Output should contain a provider with `token.actions.githubusercontent.com` in the ARN.

=== "AWS console"

    Sign in to the **AWS console** and navigate to **IAM**. Select **Identity Providers**.

    List should contain provider `token.actions.githubusercontent.com`.

---

You're done with CI/CD for IaC. You'll revisit CI/CD after setting up the application.

## Next step

Set up [application common](set-up-application-common.md).