[Bug]: Update aws_iam_openid_connect_provider for GitHub provider

[Nava-JoshLong]

Terraform Core Version

1.4.4

AWS Provider Version

4.0

Affected Resource(s)

aws_iam_openid_connect_provider

Expected Behavior

Not needing to provide a thumbprint list to the OIDC call since the changes for GitHub on AWS' side

Actual Behavior

It fails because we didn't provide a thumbprint, or one that is 40 characters

Relevant Error/Panic Output Snippet

Removing the thumbprint_list parameter: 
│ Error: Missing required argument
│ 
│   on main.tf line 2, in resource "aws_iam_openid_connect_provider" "github":
│    2: resource "aws_iam_openid_connect_provider" "github" {
│ 
│ The argument "thumbprint_list" is required, but no definition was found.

Setting it to an empty list: 
│ Error: expected length of thumbprint_list.0 to be in the range (40 - 40), got 
│ 
│   with aws_iam_openid_connect_provider.github,
│   on main.tf line 10, in resource "aws_iam_openid_connect_provider" "github":
│   10:   thumbprint_list = [""]

Terraform Configuration Files

# Set up GitHub's OpenID Connect provider in AWS account
resource "aws_iam_openid_connect_provider" "github" {
  url            = "https://token.actions.githubusercontent.com"
  client_id_list = ["sts.amazonaws.com"]

  # Remove the comment from these lines to test the different versions
  # thumbprint_list = []
  # thumbprint_list = [""]
  # thumbprint_list = ["0000000000000000000000000000000000000000"]
}

Steps to Reproduce

terraform init; terraform apply

Debug Output

No response

Panic Output

No response

Important Factoids

We are basing this off of the email we received about the changes to OIDC

We are sending this notification because you have configured a GitHub OpenID Connect (OIDC) identity provider (IdP) in your AWS account. GitHub uses a cross-signed TLS server certificate for GitHub’s OIDC servers which can have two intermediate certificates. Each of these intermediate certificates has a unique thumbprint. If you configured the GitHub IdP in your account using only one thumbprint, you may have encountered “Error: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint” when attempting to access AWS resources using GitHub as the identity provider. This would occur when the certificate thumbprint configured in AWS does not match the one presented by the GitHub server.

No action is required from you.

Starting July 6, 2023, AWS began securing communication with GitHub’s OIDC identity provider (IdP) using our library of trusted root Certificate Authorities instead of using a certificate thumbprint to verify the IdP’s server certificate. This approach ensures that your GitHub OIDC configuration behaves correctly without disruption during future certificate rotations and changes. With this new validation approach in place, your legacy thumbprint(s) will remain in your configuration but will no longer be needed for validation purposes.

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[justinretzolk]

Hey @Nava-JoshLong 👋 Thank you for taking the time to raise this! This resource uses the AWS Go SDK's CreateOpenIDConnectProvider function. Unfortunately, it appears that both the SDK function's input and the underlying API still mark the ThumbprintList as required. In order for the provider to make the requested change, we'll need to wait for an upstream change to the underlying API and SDK.

[NicoSchmidt1703]

There is also an open issue in the aws-sdk: aws/aws-sdk#563

[james-bjss]

Hey @Nava-JoshLong 👋 Thank you for taking the time to raise this! This resource uses the AWS Go SDK's CreateOpenIDConnectProvider function. Unfortunately, it appears that both the SDK function's input and the underlying API still mark the ThumbprintList as required. In order for the provider to make the requested change, we'll need to wait for an upstream change to the underlying API and SDK.

Looks like the thumbprint is now optional in the go-sdk since 1.51.20:
https://github.com/aws/aws-sdk-go/blob/main/CHANGELOG.md#release-v15120-2024-04-11

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v5.81.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!