unfunco / terraform-aws-oidc-github

Terraform module to configure GitHub Actions as an IAM OIDC identity provider in AWS.
https://registry.terraform.io/modules/unfunco/oidc-github/aws/latest
Apache License 2.0
91 stars 51 forks source link

Allow additional audiences #35

Closed MichaelChovanakDatavant closed 11 months ago

MichaelChovanakDatavant commented 11 months ago

I recently fixed an authentication issue by adding https://github.com/<organization> as an allowed audience in the github IAM trust relation, but I could not persist the change in terraform using this module.

This change adds the ability to optionally specify additional_audiences = ["<another_audience>", ...], which when omitted retains the default allowed audience of 'sts.amazonaws.com'

unfunco commented 11 months ago

Hey @MichaelChovanakDatavant – thank you for this, I'm happy for this feature to go in but can we rename the variable to additional_audiences so that it's consistent with the additional_thumbprints variable name, and can we also always include sts.amazonaws.com as an audience instead of putting it in the variable default? We do the same thing with thumbprints, we allow additional ones to be added but we don't allow the defaults to be overridden.

MichaelChovanakDatavant commented 11 months ago

@unfunco Thanks for the feedback! I've changed it to additional_audiences.

unfunco commented 11 months ago

Excellent. Thanks! I'll get a new release out shortly!