add token.actions.githubusercontent.com:aud condition

unfunco · Feb 7, 2023 · a244a9e · a244a9e
1 parent 3be2b1c
commit a244a9e
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/data.tf b/data.tf
@@ -30,6 +30,12 @@ data "aws_iam_policy_document" "assume_role" {
       variable = "token.actions.githubusercontent.com:sub"
     }
 
+    condition {
+      test     = "StringLike"
+      values   = ["sts.amazonaws.com"]
+      variable = "token.actions.githubusercontent.com:aud"
+    }
+
     principals {
       identifiers = [local.oidc_provider_arn]
       type        = "Federated"