migrate SMP from static keys to oidc

Signed-off-by: Caleb Metz <caleb.metz@datadoghq.com>

Author: cmetz100

.github/workflows/regression.yml

@@ -279,13 +279,14 @@ jobs:
     needs:
       - should-run-gate
       - resolve-inputs
+    # Job level permissions for downloading SMP binary
+    permissions:
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
-          aws-region: us-west-2
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
 
       - name: Download SMP binary
         run: |
@@ -304,6 +305,9 @@ jobs:
       - resolve-inputs
       - confirm-valid-credentials
       - build-baseline
+    # Job level permissions for uploading baseline image to SMP ECR
+    permissions:
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - name: 'Download baseline image'
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
@@ -317,9 +321,7 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
-          aws-region: us-west-2
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
 
       - name: Login to Amazon ECR
         id: login-ecr
@@ -344,6 +346,9 @@ jobs:
       - resolve-inputs
       - confirm-valid-credentials
       - build-comparison
+    # Job level permissions for uploading comparison image to SMP ECR
+    permissions:
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - name: 'Download comparison image'
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
@@ -357,9 +362,7 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
-          aws-region: us-west-2
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
 
       - name: Login to Amazon ECR
         id: login-ecr
@@ -388,6 +391,7 @@ jobs:
     permissions:
       contents: read  # Required to checkout code
       actions: write  # Required to upload artifacts
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -396,9 +400,7 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
-          aws-region: us-west-2
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
 
       - name: Login to Amazon ECR
         id: login-ecr
@@ -463,15 +465,17 @@ jobs:
       - submit-job
       - should-run-gate
       - resolve-inputs
+    # Job level permissions for downloading SMP results
+    permissions:
+      contents: read  # Required to checkout code
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
-          aws-region: us-west-2
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
 
       - name: Download SMP binary
         run: |
@@ -504,6 +508,7 @@ jobs:
     permissions:
       contents: read  # Required to checkout code
       actions: write  # Required to upload artifacts
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -512,9 +517,7 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
-          aws-region: us-west-2
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
 
       - name: Download SMP binary
         run: |