> **Page index:** https://kmtest.yngvar-hey-dev.oslo.systems/llms.txt lists every page on this site, with a link to its Markdown version.
>
> **Beyond these docs:** Team Utviklerflyt's golden-path plugin for Claude Code answers golden path questions from the source code of the platform's templates, Terraform modules and workflows. [Golden path plugin for Claude Code](/set-up-your-machine/golden-path-plugin-for-claude-code/index.md) shows how to install it.

# Set up GitHub OIDC

Set up GitHub OIDC to let GitHub Actions assume AWS roles for CI/CD without long-lived credentials. Configured via the `iam` package.

## Step 1: Add and configure the `iam` package

```bash title="repo-iac/environments/dev/"
ok pkg add iam
```

In `package-config.yml`, enable `GithubIdentityProvider`:

```yaml title="iam/package-config.yml"
StackName: "iam"
GithubIdentityProvider:
  Enable: true
```

<!-- prettier-ignore-start -->
!!! Warning "Only one per account"
    You can only have one **GithubIdentityProvider** enabled per account. If already enabled in a different environment, you cannot enable it here.

    Enabling it will cause an error when applying the stack.
<!-- prettier-ignore-end -->

## Step 2: Install and apply the package

```bash title="iam/"
ok pkg install
terraform init
terraform apply
```

## Step 3: Verify

=== "AWS CLI"

    ```bash
    aws iam list-open-id-connect-providers | jq '.OpenIDConnectProviderList[].Arn'
    ```

    Output should contain a provider with `token.actions.githubusercontent.com` in the ARN.

=== "AWS console"

    Sign in to the **AWS console** and navigate to **IAM**. Select **Identity Providers**.

    List should contain provider `token.actions.githubusercontent.com`.

---

You're done with CI/CD for IaC. You'll revisit CI/CD after setting up the application.

## Next step

Set up [application common](set-up-application-common.md).