aws-cicd-authlisted

# Purpose Define, configure, and review how the project's GitHub Actions workflows authenticate to AWS to push container images and trigger deployments. The pattern is **keyless OIDC** — GitHub Actions exchanges a short-lived OIDC token for temporary AWS STS credentials by assuming an IAM role. **No long-lived AWS access keys are stored anywhere** (not in repo secrets, not in `~/.aws`). The only secrets stored are non-sensitive identifiers (role ARN, region, repo/cluster/service names). The reference implementation is the API repo's (`project.json` → `mainApp`) `.github/workflows/deploy-prod.yml`: it assumes an IAM role via `aws-actions/configure-aws-credentials@v4`, logs into **Amazon ECR**, builds/pushes the image, and forces a new **Amazon ECS** deployment. # When to use - Setting up AWS auth for a new repo or service in the project that needs to push to ECR / deploy to ECS from GitHub Actions. - Reviewing an existing OIDC auth stanza (`permissions: id-token: write`, `configure-aws-credentials`, role ARN scoping). - Authoring or auditing the IAM **trust policy** (who can assume the CI role — the `sub`/`aud` conditions). - Authoring or auditing the IAM **permission policy** (what the CI role can do — ECR push + ECS deploy, least-privilege). - Debugging an auth failure: `Error: Could not assume role`, `Not authorized to perform sts:AssumeRoleWithWebIdentity`, ECR `denied`, ECS `AccessDenied`. - Adding a new repo/service to the existing OIDC pattern. # When NOT to use -