From 0314b209b2b9037d756538fc63586a02342f69c6 Mon Sep 17 00:00:00 2001
From: teddy931130 <info@teodordaskalov.com>
Date: Wed, 15 Jan 2025 15:33:59 +0200
Subject: [PATCH] add OIDC provider

---
 terraform/infra/dev/.terraform.lock.hcl | 24 ++++++++++++++++++++++++
 terraform/infra/dev/dev.auto.tfvars     |  4 +++-
 terraform/infra/dev/oidc.tf             | 20 ++++++++++++++++++++
 terraform/infra/dev/variables.tf        | 10 ++++++++++
 terraform/infra/dev/versions.tf         |  6 +++++-
 5 files changed, 62 insertions(+), 2 deletions(-)
 create mode 100644 terraform/infra/dev/oidc.tf

diff --git a/terraform/infra/dev/.terraform.lock.hcl b/terraform/infra/dev/.terraform.lock.hcl
index d9f78a49d4..823094d6cd 100644
--- a/terraform/infra/dev/.terraform.lock.hcl
+++ b/terraform/infra/dev/.terraform.lock.hcl
@@ -27,3 +27,27 @@ provider "registry.terraform.io/hashicorp/aws" {
     "zh:f9f51b17f2978394954e9f6ab9ef293b8e11f1443117294ccf87f7f8212b3439",
   ]
 }
+
+provider "registry.terraform.io/hashicorp/tls" {
+  version     = "4.0.6"
+  constraints = "4.0.6"
+  hashes = [
+    "h1:/sSdjHoiykrPdyBP1JE03V/KDgLXnHZhHcSOYIdDH/A=",
+    "h1:17Y+vdYNKgphpe1/SU5PBnGuYKEJkJZ7MZCnmAwsAGQ=",
+    "h1:QAuzEStYipyCgx5On0Rym6EiFfqXnBQOrgUjBY7MIbU=",
+    "h1:dYSb3V94K5dDMtrBRLPzBpkMTPn+3cXZ/kIJdtFL+2M=",
+    "h1:n3M50qfWfRSpQV9Pwcvuse03pEizqrmYEryxKky4so4=",
+    "zh:10de0d8af02f2e578101688fd334da3849f56ea91b0d9bd5b1f7a243417fdda8",
+    "zh:37fc01f8b2bc9d5b055dc3e78bfd1beb7c42cfb776a4c81106e19c8911366297",
+    "zh:4578ca03d1dd0b7f572d96bd03f744be24c726bfd282173d54b100fd221608bb",
+    "zh:6c475491d1250050765a91a493ef330adc24689e8837a0f07da5a0e1269e11c1",
+    "zh:81bde94d53cdababa5b376bbc6947668be4c45ab655de7aa2e8e4736dfd52509",
+    "zh:abdce260840b7b050c4e401d4f75c7a199fafe58a8b213947a258f75ac18b3e8",
+    "zh:b754cebfc5184873840f16a642a7c9ef78c34dc246a8ae29e056c79939963c7a",
+    "zh:c928b66086078f9917aef0eec15982f2e337914c5c4dbc31dd4741403db7eb18",
+    "zh:cded27bee5f24de6f2ee0cfd1df46a7f88e84aaffc2ecbf3ff7094160f193d50",
+    "zh:d65eb3867e8f69aaf1b8bb53bd637c99c6b649ba3db16ded50fa9a01076d1a27",
+    "zh:ecb0c8b528c7a619fa71852bb3fb5c151d47576c5aab2bf3af4db52588722eeb",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
diff --git a/terraform/infra/dev/dev.auto.tfvars b/terraform/infra/dev/dev.auto.tfvars
index c919090d02..a8d3d4ad49 100644
--- a/terraform/infra/dev/dev.auto.tfvars
+++ b/terraform/infra/dev/dev.auto.tfvars
@@ -1 +1,3 @@
-env = "dev"
\ No newline at end of file
+env = "dev"
+account_id    = "861276097334"
+region        = "eu-central-1"
diff --git a/terraform/infra/dev/oidc.tf b/terraform/infra/dev/oidc.tf
new file mode 100644
index 0000000000..99aee98e63
--- /dev/null
+++ b/terraform/infra/dev/oidc.tf
@@ -0,0 +1,20 @@
+data "tls_certificate" "github_oidc" {
+  url = "https://token.actions.githubusercontent.com"
+}
+
+resource "aws_iam_openid_connect_provider" "github" {
+  url = "https://token.actions.githubusercontent.com"
+
+  client_id_list = [
+    "sts.amazonaws.com",
+  ]
+
+  thumbprint_list = [
+    for cert in data.tls_certificate.github_oidc.certificates : cert.sha1_fingerprint
+  ]
+
+  tags = {
+    Name        = "DevOps task - GitHub OIDC Provider"
+    Environment = var.env
+  }
+}
diff --git a/terraform/infra/dev/variables.tf b/terraform/infra/dev/variables.tf
index 93956193dc..0bf434eb95 100644
--- a/terraform/infra/dev/variables.tf
+++ b/terraform/infra/dev/variables.tf
@@ -2,3 +2,13 @@ variable "env" {
   description = "The environment for the deployment"
   type        = string
 }
+
+variable "account_id" {
+  description = "The AWS account ID"
+  type        = string
+}
+
+variable "region" {
+  description = "The AWS region for creating resources"
+  type        = string
+}
diff --git a/terraform/infra/dev/versions.tf b/terraform/infra/dev/versions.tf
index b295f831c5..67e6f4c419 100644
--- a/terraform/infra/dev/versions.tf
+++ b/terraform/infra/dev/versions.tf
@@ -12,11 +12,15 @@ terraform {
       source  = "hashicorp/aws"
       version = "5.83.1"
     }
+    tls = {
+      source  = "hashicorp/tls"
+      version = "4.0.6"
+    }
   }
 
   required_version = ">= 1.9.8"
 }
 
 provider "aws" {
-  region = "eu-central-1"
+  region = var.region
 }