iam-identity-provider

Registers OIDC and SAML identity providers in IAM.

Provisions OpenID Connect providers (EKS IRSA, GitHub Actions, Bitbucket OIDC) and SAML 2.0 providers (corporate IdP federation) in the AWS account. OIDC provider ARNs are consumed by the identity/iam-role module when configuring federated trust conditions.

Usage

module "identity_providers" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/identity/iam-identity-provider/aws"
  version = "0.1.0"

  oidc_providers = {
    github_actions = {
      url            = "https://token.actions.githubusercontent.com"
      client_id_list = ["sts.amazonaws.com"]
    }
    eks = {
      url            = module.eks_cluster.oidc_issuer_url
      client_id_list = ["sts.amazonaws.com"]
    }
  }
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_iam_openid_connect_provider.this	resource
aws_iam_saml_provider.this	resource

Inputs

Name	Description	Type	Default	Required
oidc_providers	Map of OIDC identity providers to register.thumbprint_list can be omitted for providers whose certificates aremanaged automatically by AWS (e.g. EKS OIDC, token.actions.githubusercontent.com).	map(object({ url = string client_id_list = list(string) thumbprint_list = optional(list(string), []) }))	{}	no
saml_providers	Map of SAML identity providers to register — key is the provider name, value is the XML metadata document	map(object({ name = string saml_metadata_doc = string }))	{}	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
oidc_provider_arns	Map of OIDC provider logical key to ARN
oidc_provider_urls	Map of OIDC provider logical key to URL (without https://)
saml_provider_arns	Map of SAML provider logical key to ARN