diff --git a/README.md b/README.md index 2dc6079..cc824fd 100644 --- a/README.md +++ b/README.md @@ -90,6 +90,7 @@ applied, the JWT will contain an updated `iss` claim. | Name | Description | Type | Default | Required | | ----------------------------- | --------------------------------------------------------------------------- | -------------- | ---------- | :------: | +| additional_audiences | List of additional OIDC audiences allowed to assume the role. | `list(string)` | `null` | no | | additional_thumbprints | List of additional thumbprints for the OIDC provider. | `list(string)` | `null` | no | | attach_admin_policy | Flag to enable/disable the attachment of the AdministratorAccess policy. | `bool` | `false` | no | | attach_read_only_policy | Flag to enable/disable the attachment of the ReadOnly policy. | `bool` | `true` | no | diff --git a/data.tf b/data.tf index a27b2c9..b9a21b9 100644 --- a/data.tf +++ b/data.tf @@ -32,7 +32,7 @@ data "aws_iam_policy_document" "assume_role" { condition { test = "StringEquals" - values = ["sts.amazonaws.com"] + values = var.additional_audiences != null ? concat(["sts.amazonaws.com"], var.additional_audiences) : ["sts.amazonaws.com"] variable = "token.actions.githubusercontent.com:aud" } diff --git a/examples/complete/main.tf b/examples/complete/main.tf index ac04090..84d1bc1 100644 --- a/examples/complete/main.tf +++ b/examples/complete/main.tf @@ -7,6 +7,7 @@ module "aws_oidc_github" { enabled = var.enabled + additional_audiences = var.additional_audiences additional_thumbprints = var.additional_thumbprints attach_admin_policy = var.attach_admin_policy attach_read_only_policy = var.attach_read_only_policy diff --git a/examples/complete/variables.tf b/examples/complete/variables.tf index 96c8fd1..a3b98fe 100644 --- a/examples/complete/variables.tf +++ b/examples/complete/variables.tf @@ -1,3 +1,9 @@ +variable "additional_audiences" { + default = null + description = "List of additional OIDC audiences allowed to assume the role." + type = list(string) +} + variable "additional_thumbprints" { default = null description = "List of additional thumbprints for the OIDC provider." diff --git a/variables.tf b/variables.tf index bba0891..5746f14 100644 --- a/variables.tf +++ b/variables.tf @@ -12,6 +12,12 @@ // See the License for the specific language governing permissions and // limitations under the License. +variable "additional_audiences" { + default = null + description = "List of additional OIDC audiences allowed to assume the role." + type = list(string) +} + variable "additional_thumbprints" { default = null description = "List of additional thumbprints for the OIDC provider."