Update how AWS creds are resolved

Author: lauzadis

.github/actions/setup-kat/action.yml

@@ -5,11 +5,6 @@ description: >
 runs:
   using: composite
   steps:
-    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@v4
-      with:
-        role-to-assume: $CI_AWS_ROLE_ARN
-        aws-region: us-west-2
     - name: Install AWS CLI
       shell: bash
       run: |

.github/workflows/kat-verification.yml

@@ -10,6 +10,10 @@ concurrency:
   group: kat-pr-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 env:
   RUN: ${{ github.run_id }}-${{ github.run_number }}
   GRADLE_OPTS: "-Dorg.gradle.daemon=false -Dkotlin.incremental=false"
@@ -22,12 +26,19 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: 'aws-sdk-kotlin'
+
       - name: Setup Build
         uses: ./aws-sdk-kotlin/.github/actions/setup-build
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
+          aws-region: us-west-2
+
       - name: Setup kat
         uses: ./aws-sdk-kotlin/.github/actions/setup-kat
-        env:
-          CI_AWS_ROLE_ARN: ${{ secrets.CI_AWS_ROLE_ARN }}
+
       - name: Verify
         working-directory: ./aws-sdk-kotlin
         shell: bash