feat: Ensure that GitHub OIDC subject prefixes are normalied for repo: (#310)

Co-authored-by: Anton Babenko <[email protected]>

Author: bryantbiggs

examples/iam-github-oidc/main.tf

@@ -37,8 +37,14 @@ module "iam_github_oidc_provider_disabled" {
 module "iam_github_oidc_role" {
   source = "../../modules/iam-github-oidc-role"
 
+  name = local.name
+
   # This should be updated to suit your organization, repository, references/branches, etc.
-  subjects = ["terraform-aws-modules/terraform-aws-iam:*"]
+  subjects = [
+    # You can prepend with `repo:` but it is not required
+    "repo:terraform-aws-modules/terraform-aws-iam:pull_request",
+    "terraform-aws-modules/terraform-aws-iam:ref:refs/heads/master",
+  ]
 
   policies = {
     additional = aws_iam_policy.additional.arn

modules/iam-github-oidc-role/main.tf

@@ -44,7 +44,8 @@ data "aws_iam_policy_document" "this" {
     condition {
       test     = "StringLike"
       variable = "${local.provider_url}:sub"
-      values   = [for subject in var.subjects : "repo:${subject}"]
+      # Strip `repo:` to normalize for cases where users may prepend it
+      values = [for subject in var.subjects : "repo:${trimprefix(subject, "repo:")}"]
     }
   }
 }