Update Application observability Action to use IAM assuming role (#249)

*Description of changes:*
Update Application observability Action to use IAM assuming role

By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice.

Author: mxiamxia

.github/workflows/awsapm.yml

@@ -3,36 +3,34 @@ name: Application observability for AWS
 on:
   issue_comment:
     types: [created, edited]
-  pull_request_review_comment:
-    types: [created]
   issues:
     types: [opened, assigned, edited]
-  pull_request_review:
-    types: [submitted]
 
 jobs:
   awsapm-investigation:
     if: |
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@awsapm')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@awsapm')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@awsapm')) ||
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@awsapm') || contains(github.event.issue.title, '@awsapm')))
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
       issues: write
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }} # this should be the ARN of the IAM role created for Github Actions
+          aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}
+
       - name: Run Application observability for AWS Investigation
         id: awsapm
         uses: mxiamxia/aws-apm-action@main
         with:
-          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws_region: ${{ vars.AWS_REGION || 'us-east-1' }}
           bot_name: "@awsapm"