Create IAM Role

1. In the Identity Providers choose the Provider we just created

2. Choose “Assign role”

3. Choose “Create a new role” -> “Next”

4. At the Step 1
   • At Trusted Entity type we choose “Web identity”
   • At Web Identity:
     • Choose Identity Provider https://token.actions.githubusercontent.com
     • Choose Audience sts.amazonaws.com
     • Github Organization: Fill your github username (This name is case sensitive)
     • Click Next

5. At the Step 2 is AWS Managed Policy but we will create inline policy so we choose “Next”

6. At the Step 3 you will fill your role name like images and remember that role for later

7. Click “Create role”

8. At the left menu choose “Roles” -> Search your created role -> Choose that role

9. At the Permission Policies -> Choose “Add permissions” -> Create inline policy

10. At Step 1 choose JSON and copy paste the following policy (Remember change these ID for your case):

{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Sid": "SyncToBucket",
   "Effect": "Allow",
   "Action": [
    "s3:PutObject",
    "s3:GetObject",
    "s3:ListBucket",
    "s3:DeleteObject"
   ],
   "Resource": [
    "arn:aws:s3:::YOUR_BUCKET_NAME/*",
    "arn:aws:s3:::YOUR_BUCKET_NAME"
   ]
  },
  {
   "Sid": "FlushCache",
   "Effect": "Allow",
   "Action": "cloudfront:CreateInvalidation",
   "Resource": "arn:aws:cloudfront::YOUR_ACCOUNT_ID:distribution/YOUR_CLOUDFRONT_ID"
  }
 ]
}

Then click “Next” -> “Save Changes”