Terraform Core Version
1.4.4
AWS Provider Version
4.0
Affected Resource(s)
aws_iam_openid_connect_provider
Expected Behavior
Not needing to provide a thumbprint list to the OIDC call since the changes for GitHub on AWS' side
Actual Behavior
It fails because we didn't provide a thumbprint, or one that is 40 characters
Relevant Error/Panic Output Snippet
Removing the thumbprint_list parameter:
│ Error: Missing required argument
│
│ on main.tf line 2, in resource "aws_iam_openid_connect_provider" "github":
│ 2: resource "aws_iam_openid_connect_provider" "github" {
│
│ The argument "thumbprint_list" is required, but no definition was found.
Setting it to an empty list:
│ Error: expected length of thumbprint_list.0 to be in the range (40 - 40), got
│
│ with aws_iam_openid_connect_provider.github,
│ on main.tf line 10, in resource "aws_iam_openid_connect_provider" "github":
│ 10: thumbprint_list = [""]Terraform Configuration Files
# Set up GitHub's OpenID Connect provider in AWS account
resource "aws_iam_openid_connect_provider" "github" {
url = "https://token.actions.githubusercontent.com"
client_id_list = ["sts.amazonaws.com"]
# Remove the comment from these lines to test the different versions
# thumbprint_list = []
# thumbprint_list = [""]
# thumbprint_list = ["0000000000000000000000000000000000000000"]
}
Steps to Reproduce
terraform init; terraform apply
Debug Output
No response
Panic Output
No response
Important Factoids
We are basing this off of the email we received about the changes to OIDC
We are sending this notification because you have configured a GitHub OpenID Connect (OIDC) identity provider (IdP) in your AWS account. GitHub uses a cross-signed TLS server certificate for GitHub’s OIDC servers which can have two intermediate certificates. Each of these intermediate certificates has a unique thumbprint. If you configured the GitHub IdP in your account using only one thumbprint, you may have encountered “Error: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint” when attempting to access AWS resources using GitHub as the identity provider. This would occur when the certificate thumbprint configured in AWS does not match the one presented by the GitHub server.
No action is required from you.
Starting July 6, 2023, AWS began securing communication with GitHub’s OIDC identity provider (IdP) using our library of trusted root Certificate Authorities instead of using a certificate thumbprint to verify the IdP’s server certificate. This approach ensures that your GitHub OIDC configuration behaves correctly without disruption during future certificate rotations and changes. With this new validation approach in place, your legacy thumbprint(s) will remain in your configuration but will no longer be needed for validation purposes.
References
No response
Would you like to implement a fix?
None
Terraform Core Version
1.4.4
AWS Provider Version
4.0
Affected Resource(s)
aws_iam_openid_connect_provider
Expected Behavior
Not needing to provide a thumbprint list to the OIDC call since the changes for GitHub on AWS' side
Actual Behavior
It fails because we didn't provide a thumbprint, or one that is 40 characters
Relevant Error/Panic Output Snippet
Terraform Configuration Files
Steps to Reproduce
terraform init; terraform apply
Debug Output
No response
Panic Output
No response
Important Factoids
We are basing this off of the email we received about the changes to OIDC
References
No response
Would you like to implement a fix?
None