fix(iam): drop the legacy branch deploy trust (#70)

terraform/iam_github_deploy.tf

@@ -1,29 +1,4 @@
 data "aws_iam_policy_document" "github_deploy_assume" {
-  # Legacy branch trust. Remove after one deploy through cd-hcp-static has
-  # succeeded. The branch subject stays until EnvironmentProd is applied.
-  statement {
-    sid     = "LegacyBranch"
-    effect  = "Allow"
-    actions = ["sts:AssumeRoleWithWebIdentity"]
-
-    principals {
-      type        = "Federated"
-      identifiers = [data.aws_iam_openid_connect_provider.github.arn]
-    }
-
-    condition {
-      test     = "StringEquals"
-      variable = "token.actions.githubusercontent.com:aud"
-      values   = ["sts.amazonaws.com"]
-    }
-
-    condition {
-      test     = "StringLike"
-      variable = "token.actions.githubusercontent.com:sub"
-      values   = ["repo:${var.github_repo}:ref:refs/heads/${var.github_deploy_branch}"]
-    }
-  }
-
   statement {
     sid     = "EnvironmentProd"
     effect  = "Allow"

terraform/terraform.tfvars.example

@@ -4,6 +4,5 @@
 aws_region            = "us-east-1"
 domain_name           = "seahaven.com"
 github_repo           = "Sea-Haven-Industries/seahaven-site"
-github_deploy_branch  = "main"
 # Flip to true after scripts/setup_seahaven_site_domain.sh cert issues the ACM cert.
 attach_apex_alias     = false

terraform/variables.tf

@@ -16,12 +16,6 @@ variable "github_repo" {
   default     = "Sea-Haven-Industries/seahaven-site"
 }
 
-variable "github_deploy_branch" {
-  type        = string
-  description = "Git branch allowed to assume the content-deploy role"
-  default     = "main"
-}
-
 variable "attach_apex_alias" {
   type        = bool
   description = <<EOT