Example Terraform HCL file to do the same as https://awsteele.com/blog/2021/09/15/aws-federation-comes-to-github-actions.html

github-ations-with-oidc.tf

resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://vstoken.actions.githubusercontent.com"
  client_id_list  = ["sigstore"]
  thumbprint_list = ["a031c46782e6e6c662c2c87c76da9aa62ccabd8e"]
}

data "aws_iam_policy_document" "oidc-assume-role-with-web-identity" {
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = [aws_iam_openid_connect_provider.github.arn]
    }

    condition {
      test     = "StringLike"
      variable = "vstoken.actions.githubusercontent.com:sub"

      values = [
        "repo:yuya-takeyama/REPONAME:*",
      ]
    }
  }
}

resource "aws_iam_role" "main" {
  name = "github-actions-terraform"

  assume_role_policy = data.aws_iam_policy_document.oidc-assume-role-with-web-identity.json
}

data "aws_iam_policy_document" "get-caller-identity" {
  statement {
    actions   = ["sts:GetCallerIdentity"]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "main" {
  name   = "github-actions-terraform"
  policy = data.aws_iam_policy_document.get-caller-identity.json
}

resource "aws_iam_role_policy_attachment" "main" {
  role       = aws_iam_role.main.name
  policy_arn = aws_iam_policy.main.arn
}