New sub-module for IAM assumable role with OIDC

[miguelaferreira]

Description

This PR adds a new submodule that creates a single role that can be assumed by OIDC subjects. The motivation for the change is to setup IAM Roles for EKS Service Accounts.

[ipnextgen]

I dont know if it could be usefull, but here's how I implemented it meanwhile the submodule is ready. I'm using the terraform-aws-eks module for "example_aws_eks_dev_001"

data "aws_iam_policy_document" "example_alb_ingress_role_for_eks_pod_001_document" {
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    condition {
      test = "StringEquals"
      values = ["system:serviceaccount:${replace(kubernetes_service_account.example_service_account_dev_alb.id,"/",":")}"]
      variable = "${substr(module.example_aws_eks_dev_001.cluster_oidc_issuer_url, 8, length(module.example_aws_eks_dev_001.cluster_oidc_issuer_url))}:sub"
    }

    principals {
      type        = "Federated"
      identifiers = ["arn:aws:iam::${var.example_dev_aws_account_number}:oidc-provider/${substr(module.example_aws_eks_dev_001.cluster_oidc_issuer_url, 8, length(module.example_aws_eks_dev_001.cluster_oidc_issuer_url))}"]
    }
  }
}

What pisses me now is the fingerprint bug in the provider... used the workaround for now..

[ipnextgen]

Hi, will this be merged?

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.