Package com.pulumi.aws.iam

Class OpenIdConnectProviderArgs

  • public final class OpenIdConnectProviderArgs
extends com.pulumi.resources.ResourceArgs

    • Method Detail

      • clientIdLists

        public com.pulumi.core.Output<java.util.List<java.lang.String>> clientIdLists()
        Returns:
        List of client IDs (audiences) that identify the application registered with the OpenID Connect provider. This is the value sent as the `clientId` parameter in OAuth requests.

      • tags

        public java.util.Optional<com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>>> tags()
        Returns:
        Map of resource tags for the IAM OIDC provider. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.

      • thumbprintLists

        public java.util.Optional<com.pulumi.core.Output<java.util.List<java.lang.String>>> thumbprintLists()
        Returns:
        List of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s). For certain OIDC identity providers (e.g., Auth0, GitHub, GitLab, Google, or those using an Amazon S3-hosted JWKS endpoint), AWS relies on its own library of trusted root certificate authorities (CAs) for validation instead of using any configured thumbprints. In these cases, any configured `thumbprintList` is retained in the configuration but not used for verification. For other IdPs, if no `thumbprintList` is provided, IAM automatically retrieves and uses the top intermediate CA thumbprint from the OIDC IdP server certificate. However, if a `thumbprintList` is initially configured and later removed, Terraform does not prompt IAM to retrieve a thumbprint the same way. Instead, it continues using the original thumbprint list from the initial configuration. This differs from the behavior when creating an `aws.iam.OpenIdConnectProvider` without a `thumbprintList`.

      • url

        public com.pulumi.core.Output<java.lang.String> url()
        Returns:
        URL of the identity provider, corresponding to the `iss` claim.