AWS deploy workflow

[aaronhans]

This is the workflow I have been running to do deploys. It works with the OIDC provider we setup to provide deploy role so once we:

• Change the role to allow this repo as a run source (Requires admin permissions on AWS)

Anybody who runs this workflow can deploy to production.

Triggering

Right now this is a manual trigger, you click run workflow and enter the SHA. We could change this to run on new merge to main.

I'd like input from team on how we want to trigger this safely. Is merge to a protected branch fine?

Upgrades

• This does not perform DB updates
• deeper smoke test
• This might be a better way to do the deploy step https://github.com/aws-actions/aws-cloudformation-github-deploy thx @francisli

[beaudrykock-moi]

This seems sensible to me but defer to Francis and others.