diff --git a/modules/iam-github-oidc-provider/README.md b/modules/iam-github-oidc-provider/README.md
index cd5025af..c21d9085 100644
--- a/modules/iam-github-oidc-provider/README.md
+++ b/modules/iam-github-oidc-provider/README.md
@@ -52,6 +52,7 @@ No modules.
| [create](#input\_create) | Controls if resources should be created (affects all resources) | `bool` | `true` | no |
| [tags](#input\_tags) | A map of tags to add to the resources created | `map(any)` | `{}` | no |
| [url](#input\_url) | The URL of the identity provider. Corresponds to the iss claim | `string` | `"https://token.actions.githubusercontent.com"` | no |
+| [url](#openid\_config\_url) | The OIDC Identity Provider's issuer identifier containing well known configuration | `string` | `"https://token.actions.githubusercontent.com/.well-known/openid-configuration"` | no |
## Outputs
diff --git a/modules/iam-github-oidc-provider/main.tf b/modules/iam-github-oidc-provider/main.tf
index b68afb44..cb5baea5 100644
--- a/modules/iam-github-oidc-provider/main.tf
+++ b/modules/iam-github-oidc-provider/main.tf
@@ -7,7 +7,7 @@ data "aws_partition" "current" {}
data "tls_certificate" "this" {
count = var.create ? 1 : 0
- url = var.url
+ url = var.openid_config_url
}
resource "aws_iam_openid_connect_provider" "this" {
diff --git a/modules/iam-github-oidc-provider/variables.tf b/modules/iam-github-oidc-provider/variables.tf
index e405bb93..7d7bf0a6 100644
--- a/modules/iam-github-oidc-provider/variables.tf
+++ b/modules/iam-github-oidc-provider/variables.tf
@@ -21,3 +21,9 @@ variable "url" {
type = string
default = "https://token.actions.githubusercontent.com"
}
+
+variable "openid_config_url" {
+ description = "The OIDC Identity Provider's issuer identifier containing well known configuration"
+ type = string
+ default = "https://token.actions.githubusercontent.com/.well-known/openid-configuration"
+}
diff --git a/wrappers/iam-github-oidc-provider/main.tf b/wrappers/iam-github-oidc-provider/main.tf
index fb4f3d01..39b59d2d 100644
--- a/wrappers/iam-github-oidc-provider/main.tf
+++ b/wrappers/iam-github-oidc-provider/main.tf
@@ -3,8 +3,9 @@ module "wrapper" {
for_each = var.items
- create = try(each.value.create, var.defaults.create, true)
- tags = try(each.value.tags, var.defaults.tags, {})
- client_id_list = try(each.value.client_id_list, var.defaults.client_id_list, [])
- url = try(each.value.url, var.defaults.url, "https://token.actions.githubusercontent.com")
+ create = try(each.value.create, var.defaults.create, true)
+ tags = try(each.value.tags, var.defaults.tags, {})
+ client_id_list = try(each.value.client_id_list, var.defaults.client_id_list, [])
+ url = try(each.value.url, var.defaults.url, "https://token.actions.githubusercontent.com")
+ openid_config_url = try(each.value.openid_config_url, var.defaults.openid_config_url, "https://token.actions.githubusercontent.com/.well-known/openid-configuration")
}