Feature/fix oidc condition logic

[LAKostis]

Description

Correct logic in oidc_fully_qualified_subjects iteration

Motivation and Context

Current implementation of oidc_fully_qualified_subjects assumes that this will produce a list of StringEquals with one k,v but IAM just flatten this into one string with last key = value.

Moreover, we can't have multiple StringEquals for this condition:

 "Condition": {
        "StringEquals": {
          "oidc.eks.eu-west-1.amazonaws.com/id/<id>:sub": "system:serviceaccount:default:<role>"
        },
        "StringEquals": {
          "oidc.eks.eu-west-1.amazonaws.com/id/<id>:sub": "system:serviceaccount:<ns>:<role>"
        }

An error occurred: Duplicate condition element: StringEquals

My changes are define new condition logic:

   "Condition": {
       "ForAnyValue:StringEquals": {
         "oidc.eks.eu-west-1.amazonaws.com/id/<id>:sub": [
           "system:serviceaccount:<ns1>:<role>",
           "system:serviceaccount:<ns2>:<role>"
....
         ]
       }

so one can define the mappings as truly lists:

module "iam_assumable_role_oidc_default" {
  source                        = "github.com/LAKostis/terraform-aws-iam/modules/iam-assumable-role-with-oidc"
  create_role                   = true
  role_name                     = "<role>"
  provider_url                  = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
  role_policy_arns              = [data.aws_iam_policy.<policy1>.arn, data.aws_iam_policy.<policy2>.arn]
  oidc_fully_qualified_subjects = formatlist("system:serviceaccount:%s:${local.k8s_service_account_name}", var.namespaces.*)
}

Breaking Changes

Shouldn't break anything

How Has This Been Tested?

I've tested with one string and multiple strings works good so far.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.