Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Github OIDC add extra thumbprints as needed #403

Merged
merged 3 commits into from
Jul 3, 2023
Merged

feat: Github OIDC add extra thumbprints as needed #403

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a700a2e
github oidc add extra thumbprints as needed
Jul 2, 2023
4f56ba9
add default values and update var name
Jul 3, 2023
16c9460
move comment out of list for pre-commit fix
Jul 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions examples/iam-github-oidc/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,12 @@ locals {
module "iam_github_oidc_provider" {
source = "../../modules/iam-github-oidc-provider"

# https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/
additional_thumbprint_list = [
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of putting these values in the examples, we would rather have them as defaults, so users should just upgrade the version of the module and use it right away.

/cc @bryantbiggs WDYT?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ya we can try that. I've checked internally as well and there isn't a clear path to resolution so lets try and see what happens

"6938fd4d98bab03faadb97b34396831e3780aea1",
"1c58a3a8518e8759bf075b76b750d4f2df264fcd"
]

tags = local.tags
}

Expand Down
1 change: 1 addition & 0 deletions modules/iam-github-oidc-provider/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ No modules.

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_additional_thumbprint_list"></a> [additional\_thumbprint\_list](#input\_additional\_thumbprint\_list) | List of additional thumbprints to add to the thumbprint list. | `list(string)` | `[]` | no |
| <a name="input_client_id_list"></a> [client\_id\_list](#input\_client\_id\_list) | List of client IDs (also known as audiences) for the IAM OIDC provider. Defaults to STS service if not values are provided | `list(string)` | `[]` | no |
| <a name="input_create"></a> [create](#input\_create) | Controls if resources should be created (affects all resources) | `bool` | `true` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to the resources created | `map(any)` | `{}` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/iam-github-oidc-provider/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ resource "aws_iam_openid_connect_provider" "this" {

url = var.url
client_id_list = coalescelist(var.client_id_list, ["sts.${data.aws_partition.current.dns_suffix}"])
thumbprint_list = data.tls_certificate.this[0].certificates[*].sha1_fingerprint
thumbprint_list = distinct(concat(data.tls_certificate.this[0].certificates[*].sha1_fingerprint, var.additional_thumbprint_list))

tags = var.tags
}
6 changes: 6 additions & 0 deletions modules/iam-github-oidc-provider/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,9 @@ variable "url" {
type = string
default = "https://token.actions.githubusercontent.com"
}

variable "additional_thumbprint_list" {
magreenbaum marked this conversation as resolved.
Show resolved Hide resolved
description = "List of additional thumbprints to add to the thumbprint list."
type = list(string)
default = []
}
9 changes: 5 additions & 4 deletions wrappers/iam-github-oidc-provider/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,9 @@ module "wrapper" {

for_each = var.items

create = try(each.value.create, var.defaults.create, true)
tags = try(each.value.tags, var.defaults.tags, {})
client_id_list = try(each.value.client_id_list, var.defaults.client_id_list, [])
url = try(each.value.url, var.defaults.url, "https://token.actions.githubusercontent.com")
create = try(each.value.create, var.defaults.create, true)
tags = try(each.value.tags, var.defaults.tags, {})
client_id_list = try(each.value.client_id_list, var.defaults.client_id_list, [])
url = try(each.value.url, var.defaults.url, "https://token.actions.githubusercontent.com")
additional_thumbprint_list = try(each.value.additional_thumbprint_list, var.defaults.additional_thumbprint_list, [])
}