Allow additional audiences

README.md

@@ -90,6 +90,7 @@ applied, the JWT will contain an updated `iss` claim.
 
 | Name                          | Description                                                                 | Type           | Default    | Required |
 | ----------------------------- | --------------------------------------------------------------------------- | -------------- | ---------- | :------: |
+| additional_audiences          | List of additional OIDC audiences allowed to assume the role.               | `list(string)` | `null`     |    no    |
 | additional_thumbprints        | List of additional thumbprints for the OIDC provider.                       | `list(string)` | `null`     |    no    |
 | attach_admin_policy           | Flag to enable/disable the attachment of the AdministratorAccess policy.    | `bool`         | `false`    |    no    |
 | attach_read_only_policy       | Flag to enable/disable the attachment of the ReadOnly policy.               | `bool`         | `true`     |    no    |

data.tf

@@ -32,7 +32,7 @@ data "aws_iam_policy_document" "assume_role" {
 
     condition {
       test     = "StringEquals"
-      values   = ["sts.amazonaws.com"]
+      values   = var.additional_audiences != null ? concat(["sts.amazonaws.com"], var.additional_audiences) : ["sts.amazonaws.com"]
       variable = "token.actions.githubusercontent.com:aud"
     }
 

examples/complete/main.tf

@@ -7,6 +7,7 @@ module "aws_oidc_github" {
 
   enabled = var.enabled
 
+  additional_audiences          = var.additional_audiences
   additional_thumbprints        = var.additional_thumbprints
   attach_admin_policy           = var.attach_admin_policy
   attach_read_only_policy       = var.attach_read_only_policy

examples/complete/variables.tf

@@ -1,3 +1,9 @@
+variable "additional_audiences" {
+  default     = null
+  description = "List of additional OIDC audiences allowed to assume the role."
+  type        = list(string)
+}
+
 variable "additional_thumbprints" {
   default     = null
   description = "List of additional thumbprints for the OIDC provider."

variables.tf

@@ -12,6 +12,12 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+variable "additional_audiences" {
+  default     = null
+  description = "List of additional OIDC audiences allowed to assume the role."
+  type        = list(string)
+}
+
 variable "additional_thumbprints" {
   default     = null
   description = "List of additional thumbprints for the OIDC provider."