Move permissions to the job

safe-global · May 6, 2024 · 4dca40d · 4dca40d
1 parent 25b99b9
commit 4dca40d
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 8 deletions.
diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
@@ -12,10 +12,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -50,6 +46,8 @@ jobs:
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v3
+        permissions:
+          id-token: write
         with:
           role-to-assume: ${{ secrets.AWS_ROLE }}
           aws-region: ${{ secrets.AWS_REGION }}

diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
@@ -4,10 +4,6 @@ on:
   release:
     types: [published]
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -52,6 +48,8 @@ jobs:
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v3
+        permissions:
+          id-token: write
         with:
           role-to-assume: ${{ secrets.AWS_ROLE }}
           aws-region: ${{ secrets.AWS_REGION }}