diff --git a/modules/iam-github-oidc-provider/README.md b/modules/iam-github-oidc-provider/README.md index cd5025af..c21d9085 100644 --- a/modules/iam-github-oidc-provider/README.md +++ b/modules/iam-github-oidc-provider/README.md @@ -52,6 +52,7 @@ No modules. | [create](#input\_create) | Controls if resources should be created (affects all resources) | `bool` | `true` | no | | [tags](#input\_tags) | A map of tags to add to the resources created | `map(any)` | `{}` | no | | [url](#input\_url) | The URL of the identity provider. Corresponds to the iss claim | `string` | `"https://token.actions.githubusercontent.com"` | no | +| [url](#openid\_config\_url) | The OIDC Identity Provider's issuer identifier containing well known configuration | `string` | `"https://token.actions.githubusercontent.com/.well-known/openid-configuration"` | no | ## Outputs diff --git a/modules/iam-github-oidc-provider/main.tf b/modules/iam-github-oidc-provider/main.tf index b68afb44..cb5baea5 100644 --- a/modules/iam-github-oidc-provider/main.tf +++ b/modules/iam-github-oidc-provider/main.tf @@ -7,7 +7,7 @@ data "aws_partition" "current" {} data "tls_certificate" "this" { count = var.create ? 1 : 0 - url = var.url + url = var.openid_config_url } resource "aws_iam_openid_connect_provider" "this" { diff --git a/modules/iam-github-oidc-provider/variables.tf b/modules/iam-github-oidc-provider/variables.tf index e405bb93..7d7bf0a6 100644 --- a/modules/iam-github-oidc-provider/variables.tf +++ b/modules/iam-github-oidc-provider/variables.tf @@ -21,3 +21,9 @@ variable "url" { type = string default = "https://token.actions.githubusercontent.com" } + +variable "openid_config_url" { + description = "The OIDC Identity Provider's issuer identifier containing well known configuration" + type = string + default = "https://token.actions.githubusercontent.com/.well-known/openid-configuration" +} diff --git a/wrappers/iam-github-oidc-provider/main.tf b/wrappers/iam-github-oidc-provider/main.tf index fb4f3d01..39b59d2d 100644 --- a/wrappers/iam-github-oidc-provider/main.tf +++ b/wrappers/iam-github-oidc-provider/main.tf @@ -3,8 +3,9 @@ module "wrapper" { for_each = var.items - create = try(each.value.create, var.defaults.create, true) - tags = try(each.value.tags, var.defaults.tags, {}) - client_id_list = try(each.value.client_id_list, var.defaults.client_id_list, []) - url = try(each.value.url, var.defaults.url, "https://token.actions.githubusercontent.com") + create = try(each.value.create, var.defaults.create, true) + tags = try(each.value.tags, var.defaults.tags, {}) + client_id_list = try(each.value.client_id_list, var.defaults.client_id_list, []) + url = try(each.value.url, var.defaults.url, "https://token.actions.githubusercontent.com") + openid_config_url = try(each.value.openid_config_url, var.defaults.openid_config_url, "https://token.actions.githubusercontent.com/.well-known/openid-configuration") }