SCALRCORE-27266 Provider configurations > AWS OIDC.

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- `scalr_provider_configuration`: added new `aws.workload_identity_audience` attribute; `aws.account_type` attribute became optional ([#260](https://github.com/Scalr/terraform-provider-scalr/pull/260))
+
 ## [1.2.0] - 2023-07-14
 
 ### Changed

docs/resources/scalr_provider_configuration.md

@@ -37,6 +37,20 @@ resource "scalr_provider_configuration" "aws" {
 }
 ```
 
+```hcl
+resource "scalr_provider_configuration" "oidc" {
+  name                   = "oidc_dev_us_east_1"
+  account_id             = "acc-xxxxxxxxx"
+  export_shell_variables = false
+  environments           = ["*"]
+  aws {
+    credentials_type           = "oidc"
+    role_arn                   = "arn:aws:iam::123456789012:role/scalr-oidc-role"
+    workload_identity_audience = "aws.scalr-run-workload"
+  }
+}
+```
+
 To get into more advanced AWS usage please refer to the official [AWS module](https://github.com/Scalr/terraform-scalr-provider-configuration-aws).
 
 ### AzureRM provider:
@@ -118,13 +132,14 @@ resource "scalr_provider_configuration" "kubernetes" {
     * `token` - (Optional) The Scalr token which should be used.
 * `aws` - (Optional) Settings for the aws provider configuration. Exactly one of the following attributes must be set: `scalr`, `aws`, `google`, `azurerm`, `custom`.
    The `aws` block supports the following:
-  * `account_type` - (Required) The type of AWS account, available options: `regular`, `gov-cloud`, `cn-cloud`.
   * `credentials_type` - (Required) The type of AWS credentials, available options: `access_keys`, `role_delegation`.
+  * `account_type` - (Optional) The type of AWS account, available options: `regular`, `gov-cloud`, `cn-cloud`.
   * `trusted_entity_type` - (Optional) Trusted entity type, available options: `aws_account`, `aws_service`. This option is required with `role_delegation` credentials type.
-  * `role_arn` - (Optional) Amazon Resource Name (ARN) of the IAM Role to assume. This option is required with the `role_delegation` credentials type.
+  * `role_arn` - (Optional) Amazon Resource Name (ARN) of the IAM Role to assume. This option is required with the `role_delegation` and `oidc` credentials type.
   * `external_id` - (Optional) External identifier to use when assuming the role. This option is required with `role_delegation` credentials type and `aws_account` trusted entity type.
   * `secret_key` - (Optional) AWS secret key. This option is required with `access_keys` credentials type.
   * `access_key` - (Optional) AWS access key. This option is required with `access_keys` credentials type.
+  * `workload_identity_audience` - (Optional) The value of the `aud` claim for the identity token. This option is required with `oidc` credentials type.
 * `google` - (Optional) Settings for the google provider configuration. Exactly one of the following attributes must be set: `scalr`, `aws`, `google`, `azurerm`, `custom`.
    The `google` block supports the following:
   * `auth_type` - (Optional) Authentication type, either `service-account-key` (default) or `oidc`.

go.mod

@@ -5,7 +5,7 @@ require (
 	github.com/hashicorp/hcl v0.0.0-20180404174102-ef8a98b0bbce
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.24.1
 	github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734
-	github.com/scalr/go-scalr v0.0.0-20230623114831-761a3890bd58
+	github.com/scalr/go-scalr v0.0.0-20230714115336-140805955ba6
 )
 
 require (

go.sum

@@ -242,8 +242,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/scalr/go-scalr v0.0.0-20230623114831-761a3890bd58 h1:z1TCIpAwbTBWGL0Ldp7MqJ8wrlXgMTgU3mDUj9lRuvA=
-github.com/scalr/go-scalr v0.0.0-20230623114831-761a3890bd58/go.mod h1:p34SHb25YRvbgft7SUjSDYESeoQhWzAlxGXId/BbaSE=
+github.com/scalr/go-scalr v0.0.0-20230714115336-140805955ba6 h1:O6pWXH1vdMJVys9mC077S5km+I0hQ5m5xn+OllvMq8Q=
+github.com/scalr/go-scalr v0.0.0-20230714115336-140805955ba6/go.mod h1:p34SHb25YRvbgft7SUjSDYESeoQhWzAlxGXId/BbaSE=
 github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=

scalr/resource_scalr_provider_configuration.go

@@ -72,7 +72,8 @@ func resourceScalrProviderConfiguration() *schema.Resource {
 					Schema: map[string]*schema.Schema{
 						"account_type": {
 							Type:     schema.TypeString,
-							Required: true,
+							Optional: true,
+							Default:  "regular",
 						},
 						"credentials_type": {
 							Type:     schema.TypeString,
@@ -99,6 +100,10 @@ func resourceScalrProviderConfiguration() *schema.Resource {
 							Optional:  true,
 							Sensitive: true,
 						},
+						"audience": {
+							Type:     schema.TypeString,
+							Optional: true,
+						},
 					},
 				},
 			},
@@ -286,6 +291,15 @@ func resourceScalrProviderConfigurationCreate(ctx context.Context, d *schema.Res
 			if *configurationOptions.AwsTrustedEntityType == "aws_account" && (!externalIdExists || (len(externalIdI.(string)) == 0)) {
 				return diag.Errorf("'external_id' field is required for 'role_delegation' credentials type with 'aws_account' trusted entity type of aws provider configuration")
 			}
+		} else if *configurationOptions.AwsCredentialsType == "oidc" {
+			configurationOptions.AwsRoleArn = scalr.String(d.Get("aws.0.role_arn").(string))
+			configurationOptions.AwsAudience = scalr.String(d.Get("aws.0.audience").(string))
+			if len(*configurationOptions.AwsRoleArn) == 0 {
+				return diag.Errorf("'role_arn' field is required for 'oidc' credentials type of aws provider configuration")
+			}
+			if len(*configurationOptions.AwsAudience) == 0 {
+				return diag.Errorf("'audience' field is required for 'oidc' credentials type of aws provider configuration")
+			}
 		} else if *configurationOptions.AwsCredentialsType != "access_keys" {
 			return diag.Errorf("unknown aws provider configuration credentials type: %s, allowed: 'role_delegation', 'access_keys'", *configurationOptions.AwsCredentialsType)
 		} else if !accessKeyIdExists || !accessSecretKeyExists {
@@ -488,6 +502,9 @@ func resourceScalrProviderConfigurationRead(ctx context.Context, d *schema.Resou
 			if len(providerConfiguration.AwsExternalId) > 0 {
 				aws["external_id"] = providerConfiguration.AwsExternalId
 			}
+			if len(providerConfiguration.AwsAudience) > 0 {
+				aws["audience"] = providerConfiguration.AwsAudience
+			}
 
 			_ = d.Set("aws", []map[string]interface{}{aws})
 		case "google":
@@ -620,6 +637,15 @@ func resourceScalrProviderConfigurationUpdate(ctx context.Context, d *schema.Res
 				if *configurationOptions.AwsTrustedEntityType == "aws_account" && (!externalIdExists || (len(externalIdI.(string)) == 0)) {
 					return diag.Errorf("'external_id' field is required for 'role_delegation' credentials type with 'aws_account' entity type of aws provider configuration")
 				}
+			} else if *configurationOptions.AwsCredentialsType == "oidc" {
+				configurationOptions.AwsRoleArn = scalr.String(d.Get("aws.0.role_arn").(string))
+				configurationOptions.AwsAudience = scalr.String(d.Get("aws.0.audience").(string))
+				if len(*configurationOptions.AwsRoleArn) == 0 {
+					return diag.Errorf("'role_arn' field is required for 'oidc' credentials type of aws provider configuration")
+				}
+				if len(*configurationOptions.AwsAudience) == 0 {
+					return diag.Errorf("'audience' field is required for 'oidc' credentials type of aws provider configuration")
+				}
 			} else if *configurationOptions.AwsCredentialsType != "access_keys" {
 				return diag.Errorf("unknown aws provider configuration credentials type: %s, allowed: 'role_delegation', 'access_keys'", *configurationOptions.AwsCredentialsType)
 			} else if !accessKeyIdExists || !accessSecretKeyExists {

scalr/resource_scalr_provider_configuration_test.go

@@ -359,6 +359,44 @@ func TestAccProviderConfiguration_google_oidc(t *testing.T) {
 	})
 }
 
+func TestAccProviderConfiguration_aws_oidc(t *testing.T) {
+	var providerConfiguration scalr.ProviderConfiguration
+	rName := acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum)
+	rNewName := acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum)
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:          func() { testAccPreCheck(t) },
+		ProviderFactories: testAccProviderFactories,
+		CheckDestroy:      testAccCheckProviderConfigurationResourceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccScalrProviderConfigurationAWSOidcConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckProviderConfigurationExists("scalr_provider_configuration.aws", &providerConfiguration),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "name", rName),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "export_shell_variables", "false"),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "aws.#", "1"),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "aws.0.role_arn", "arn:aws:iam::123456789012:role/scalr-oidc-role"),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "aws.0.credentials_type", "oidc"),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "aws.0.audience", "aws.scalr-run-workload"),
+				),
+			},
+			{
+				Config: testAccScalrProviderConfigurationAWSOidcUpdatedConfig(rNewName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckProviderConfigurationExists("scalr_provider_configuration.aws", &providerConfiguration),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "name", rNewName),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "export_shell_variables", "false"),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "aws.#", "1"),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "aws.0.role_arn", "arn:aws:iam::123456789012:role/scalr-oidc-role2"),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "aws.0.credentials_type", "oidc"),
+					resource.TestCheckResourceAttr("scalr_provider_configuration.aws", "aws.0.audience", "aws.scalr-run-workload2"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccProviderConfiguration_azurerm(t *testing.T) {
 	if true {
 		t.Skip("TODO: add a valid credentials for azurerm testing.")
@@ -920,6 +958,34 @@ resource "scalr_provider_configuration" "google" {
 `, name, defaultAccount, project)
 }
 
+func testAccScalrProviderConfigurationAWSOidcConfig(name string) string {
+	return fmt.Sprintf(`
+resource "scalr_provider_configuration" "aws" {
+  name       = "%s"
+  account_id = "%s"
+  aws {
+    credentials_type           = "oidc"
+    role_arn                   = "arn:aws:iam::123456789012:role/scalr-oidc-role"
+    audience = "aws.scalr-run-workload"
+  }
+}
+`, name, defaultAccount)
+}
+
+func testAccScalrProviderConfigurationAWSOidcUpdatedConfig(name string) string {
+	return fmt.Sprintf(`
+resource "scalr_provider_configuration" "aws" {
+  name       = "%s"
+  account_id = "%s"
+  aws {
+    credentials_type           = "oidc"
+    role_arn                   = "arn:aws:iam::123456789012:role/scalr-oidc-role2"
+    audience = "aws.scalr-run-workload2"
+  }
+}
+`, name, defaultAccount)
+}
+
 func testAccScalrProviderConfigurationGoogleConfig(name, credentials, project string) string {
 	return fmt.Sprintf(`
 resource "scalr_provider_configuration" "google" {