OpenID Connect (OIDC) allows GitHub Workflows to access AWS. Refer to the following guide how this is set up.

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services 

The ARN of the role that is set up with the GitHub identity provider is stored as the OICD_AWS_ROLE_TO_ASSUME variable.