Fix OIDC Assume Role policy for multiple subjects

[lawliet89]

Consider the following usage of the module:

module "role" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"

  create_role  = true
  role_name    = "role"
  provider_url = "oidc.eks.ap-southeast-1.amazonaws.com/id/xxx"

  oidc_fully_qualified_subjects = [
    "system:serviceaccount:core:sa1",
    "system:serviceaccount:core:sa2",
  ]
}

The module created the following policy

data "aws_iam_policy_document" "assume_role_with_oidc" {
    id      = "2809270776"
    json    = jsonencode(
        {
            Statement = [
                {
                    Action    = "sts:AssumeRoleWithWebIdentity"
                    Condition = {
                        StringEquals = {
                            oidc.eks.ap-southeast-1.amazonaws.com/id/xxx:sub = "system:serviceaccount:core:sa2"
                        }
                    }
                    Effect    = "Allow"
                    Principal = {
                        Federated = "arn:aws:iam::xxx:oidc-provider/oidc.eks.ap-southeast-1.amazonaws.com/id/xxx"
                    }
                    Sid       = ""
                },
            ]
            Version   = "2012-10-17"
        }
    )
    version = "2012-10-17"

    statement {
        actions       = [
            "sts:AssumeRoleWithWebIdentity",
        ]
        effect        = "Allow"
        not_actions   = []
        not_resources = []
        resources     = []

        condition {
            test     = "StringEquals"
            values   = [
                "system:serviceaccount:core:sa1",
            ]
            variable = "oidc.eks.ap-southeast-1.amazonaws.com/id/xxx:sub"
        }
        condition {
            test     = "StringEquals"
            values   = [
                "system:serviceaccount:core:sa2",
            ]
            variable = "oidc.eks.ap-southeast-1.amazonaws.com/id/xxx:sub"
        }

        principals {
            identifiers = [
                "arn:aws:iam::xxx:oidc-provider/oidc.eks.ap-southeast-1.amazonaws.com/id/xxx",
            ]
            type        = "Federated"
        }
    }
}

If you look at the JSON generated, the two StringEquals test conditions overwrote each other.

With this PR, the policies are now:

data "aws_iam_policy_document" "assume_role_with_oidc" {
    id      = "4277879168"
    json    = jsonencode(
        {
            Statement = [
                {
                    Action    = "sts:AssumeRoleWithWebIdentity"
                    Condition = {
                        StringEquals = {
                            oidc.eks.ap-southeast-1.amazonaws.com/id/xxx:sub = [
                                "system:serviceaccount:core:sa1",
                                "system:serviceaccount:core:sa2",
                            ]
                        }
                    }
                    Effect    = "Allow"
                    Principal = {
                        Federated = "arn:aws:iam::xxx:oidc-provider/oidc.eks.ap-southeast-1.amazonaws.com/id/xxx"
                    }
                    Sid       = ""
                },
            ]
            Version   = "2012-10-17"
        }
    )
    version = "2012-10-17"

    statement {
        actions       = [
            "sts:AssumeRoleWithWebIdentity",
        ]
        effect        = "Allow"
        not_actions   = []
        not_resources = []
        resources     = []

        condition {
            test     = "StringEquals"
            values   = [
                "system:serviceaccount:core:sa1",
                "system:serviceaccount:core:sa2",
            ]
            variable = "oidc.eks.ap-southeast-1.amazonaws.com/id/xxx:sub"
        }

        principals {
            identifiers = [
                "arn:aws:iam::xxx:oidc-provider/oidc.eks.ap-southeast-1.amazonaws.com/id/xxx",
            ]
            type        = "Federated"
        }
    }
}

[lawliet89]

Fixed by #74

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.