# iam-identity-provider

Registers OIDC and SAML identity providers in IAM.

Provisions OpenID Connect providers (EKS IRSA, GitHub Actions, Bitbucket OIDC) and SAML 2.0 providers (corporate IdP federation) in the AWS account. OIDC provider ARNs are consumed by the `identity/iam-role` module when configuring federated trust conditions.

## Usage

```hcl
module "identity_providers" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/identity/iam-identity-provider/aws"
  version = "0.1.0"

  oidc_providers = {
    github_actions = {
      url            = "https://token.actions.githubusercontent.com"
      client_id_list = ["sts.amazonaws.com"]
    }
    eks = {
      url            = module.eks_cluster.oidc_issuer_url
      client_id_list = ["sts.amazonaws.com"]
    }
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_iam_openid_connect_provider.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
| [aws_iam_saml_provider.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_saml_provider) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_oidc_providers"></a> [oidc_providers](#input_oidc_providers) | Map of OIDC identity providers to register.<br/>thumbprint_list can be omitted for providers whose certificates are<br/>managed automatically by AWS (e.g. EKS OIDC, token.actions.githubusercontent.com). | <pre>map(object({<br/>    url             = string<br/>    client_id_list  = list(string)<br/>    thumbprint_list = optional(list(string), [])<br/>  }))</pre> | `{}` | no |
| <a name="input_saml_providers"></a> [saml_providers](#input_saml_providers) | Map of SAML identity providers to register — key is the provider name, value is the XML metadata document | <pre>map(object({<br/>    name              = string<br/>    saml_metadata_doc = string<br/>  }))</pre> | `{}` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_oidc_provider_arns"></a> [oidc_provider_arns](#output_oidc_provider_arns) | Map of OIDC provider logical key to ARN |
| <a name="output_oidc_provider_urls"></a> [oidc_provider_urls](#output_oidc_provider_urls) | Map of OIDC provider logical key to URL (without https://) |
| <a name="output_saml_provider_arns"></a> [saml_provider_arns](#output_saml_provider_arns) | Map of SAML provider logical key to ARN |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->