WTF IAM

Let's see how to give GitHub Actions permissions to our AWS resources securely, without fear of exposing static AWS credentials to the internet.

Dealing with IAM permissions for S3 can be frustrating, because it has some wonky rules. These aren't obvious at first, so I spell them out here.

There's actually a bunch of different types of policies! Learn what the docs mean by identity-based policies, resource-based policies, and some other weirder ones.

There's a lot to say about IAM. We're going to say some of it - to get a sense of what the moving parts are.