如何借助GitHub Actions OIDC功能通过Serverless Framework部署AWS Lambda

我此前参考了Stack Overflow上的相关问题，想要在原有无密钥连接GitHub Actions与AWS部署的方案基础上，进一步实现通过Serverless框架部署Lambda函数，目前已尝试的配置如下：

name: For Production

on:
  push:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    strategy:
      matrix:
        node-version: [16.x]
        # 支持的Node.js发布时间表可参考Node.js官方文档

    steps:
      - uses: actions/checkout@v2
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v2
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
          cache-dependency-path: ./backend-operations/package-lock.json
      - name: 创建环境变量文件
        run: |
          touch ./backend-operations/.env
          echo JWKS_URI=${{secrets.JWKS_URI}} >> ./backend-operations/.env
          echo AUDIENCE=${{ secrets.AUDIENCE }} >> ./backend-operations/.env
          echo TOKEN_ISSUER=${{ secrets.TOKEN_ISSUER }} >> ./backend-operations/.env
      - run: npm ci
        working-directory: ./backend-operations
      - run: npm run build --if-present
        working-directory: ./backend-operations
      - run: npm test
        working-directory: ./backend-operations
      - name: 安装Serverless框架
        run: npm install -g serverless
      - name: 配置AWS凭证
        run: |
          sleep 5 # 需要延迟等待凭证获取
          export AWS_ROLE_ARN=arn:aws:iam::xxxxxxx:role/my-role
          export AWS_WEB_IDENTITY_TOKEN_FILE=/tmp/awscreds
          export AWS_DEFAULT_REGION=ap-southeast-1

          echo AWS_WEB_IDENTITY_TOKEN_FILE=$AWS_WEB_IDENTITY_TOKEN_FILE >> $GITHUB_ENV
          echo AWS_ROLE_ARN=$AWS_ROLE_ARN >> $GITHUB_ENV
          echo AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION >> $GITHUB_ENV

          curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=githubactions" \
            | jq -r '.value' > $AWS_WEB_IDENTITY_TOKEN_FILE
            
          sls deploy --stage prod --verbose
        working-directory: './backend-operations'
      
      # - name: 部署到AWS
      #   run: serverless deploy --stage prod --verbose
      #   working-directory: './backend-operations'
      - name: 上传覆盖率报告到Codecov
        uses: codecov/codecov-action@v1
        with:
          token: ${{secrets.CODECOV_SECRET_TOKEN}}

内容的提问来源于stack exchange，提问作者Jatin Mehrotra