variable "oidc_issuer" {
  type = string
}

variable "auto_deploy_owner_tag" {
  type = string
}

data "tls_certificate" "oidc" {
  url = var.oidc_issuer
}

resource "aws_iam_openid_connect_provider" "oidc" {
  client_id_list  = ["sts.amazonaws.com", "https://kubernetes.default.svc"]
  thumbprint_list = [data.tls_certificate.oidc.certificates[0].sha1_fingerprint]
  url             = var.oidc_issuer

  tags = {
    "tidbcloud-auto-deploy-owner" = var.auto_deploy_owner_tag
  }
}

output "oidc_arn" {
  value = aws_iam_openid_connect_provider.oidc.arn
}