fix: add oidc input to assume role policy (#671)

aws-iam-role-s3-readonly/main.tf

@@ -11,6 +11,7 @@ module "assume_role_policy" {
   source             = "../aws-assume-role-policy"
   source_account_ids = var.source_account_ids
   saml_idp_arns      = var.saml_idp_arns
+  oidc               = var.oidc
   env                = var.env
   owner              = var.owner
   service            = var.service

aws-iam-role-s3-readonly/variables.tf

@@ -29,6 +29,19 @@ variable "saml_idp_arns" {
   description = "The AWS SAML IDP arns to establish a trust relationship. Ignored if empty or not provided."
 }
 
+variable "oidc" {
+  type = list(object(
+    {
+      idp_arn : string,          # the AWS IAM IDP arn
+      client_ids : list(string), # a list of oidc client ids
+      provider : string          # your provider url, such as foo.okta.com
+    }
+  ))
+
+  default     = []
+  description = "A list of AWS OIDC IDPs to establish a trust relationship for this role."
+}
+
 variable "project" {
   type        = string
   description = "Project for tagging and naming. See [doc](../README.md#consistent-tagging)"