fix: OIDC condition no longer relies on value that may not be available at runtime.

Author: jamesiarmes

data.tf

@@ -11,7 +11,10 @@ data "aws_route53_zone" "domain" {
 }
 
 data "aws_secretsmanager_secret_version" "oidc" {
-  for_each = nonsensitive(try(var.oidc_settings.client_secret_arn, null)) != null ? toset(["this"]) : toset([])
+  for_each = (
+    var.oidc_settings != null &&
+    nonsensitive(try(var.oidc_settings.client_id, null)) == null
+  ) ? toset(["this"]) : toset([])
 
   secret_id = var.oidc_settings.client_secret_arn
 }