Skip to content

Commit ccac009

Browse files
jamesiarmesjamesiarmes
authored
feat: Allow the OIDC scope to be configured. (#62)
1 parent c4f14b5 commit ccac009

2 files changed

Lines changed: 23 additions & 21 deletions

File tree

‎README.md‎

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -104,13 +104,13 @@ Your application retrieves configuration by making HTTP GET requests to
104104
`http://localhost:2772/applications/{app}/environments/{env}/configurations/{profile}`.
105105
The port can be customized with `appconfig_agent_port`.
106106

107-
| Name | Description | Type | Default | Required |
108-
|---------------------------------------|------------------------------------------------------------------------------|---------------|---------|-------------|
109-
| enable_appconfig_agent | Enable the AWS AppConfig Agent sidecar container. | `bool` | `false` | no |
110-
| appconfig_agent_application_id | AppConfig application ID to scope IAM permissions. | `string` | `""` | conditional |
111-
| appconfig_agent_environment_variables | Environment variables for the AppConfig Agent sidecar. | `map(string)` | `{}` | no |
112-
| appconfig_agent_port | Port for the AppConfig Agent HTTP server. | `number` | `2772` | no |
113-
| appconfig_agent_version | Version of the AWS AppConfig Agent image. Pin for production stability. | `string` | `"2.x"` | no |
107+
| Name | Description | Type | Default | Required |
108+
| ------------------------------------- | ----------------------------------------------------------------------- | ------------- | ------- | ----------- |
109+
| enable_appconfig_agent | Enable the AWS AppConfig Agent sidecar container. | `bool` | `false` | no |
110+
| appconfig_agent_application_id | AppConfig application ID to scope IAM permissions. | `string` | `""` | conditional |
111+
| appconfig_agent_environment_variables | Environment variables for the AppConfig Agent sidecar. | `map(string)` | `{}` | no |
112+
| appconfig_agent_port | Port for the AppConfig Agent HTTP server. | `number` | `2772` | no |
113+
| appconfig_agent_version | Version of the AWS AppConfig Agent image. Pin for production stability. | `string` | `"2.x"` | no |
114114

115115
### Configuring OpenTelemetry
116116

@@ -167,7 +167,7 @@ The OpenTelemetry collector sidecar is always included and reserves a fixed
167167
portion of the task resources:
168168

169169
| Container | CPU (units) | Memory (MiB) |
170-
|----------------------|-------------|--------------|
170+
| -------------------- | ----------- | ------------ |
171171
| OTEL Collector | 256 | 512 |
172172
| **Your application** | Remainder | Remainder |
173173

@@ -193,7 +193,7 @@ the AppConfig Agent is enabled.
193193
> now to avoid unexpected changes in the future.
194194
195195
| Name | Description | Type | Default | Required |
196-
|-----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|-------------|-------------|
196+
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- | ----------- | ----------- |
197197
| logging_key_id | KMS key to use for log encryption. | `string` | n/a | yes |
198198
| private_subnets | List of private subnet CIDR blocks. | `list` | n/a | yes |
199199
| project | Name of the project. | `string` | n/a | yes |
@@ -346,15 +346,16 @@ oidc_settings = {
346346
}
347347
```
348348

349-
| Name | Description | Type | Default | Required |
350-
|------------------------|------------------------------------------------------------------|----------|---------|-------------|
351-
| authorization_endpoint | Authorization endpoint from your provider. | `string` | n/a | yes |
352-
| issuer | Issuer endpoint from your provider. | `string` | n/a | yes |
353-
| token_endpoint | Token endpoint from your provider. | `string` | n/a | yes |
354-
| user_info_endpoint | User info endpoint from your provider. | `string` | n/a | yes |
355-
| client_id | Client ID from your provider. | `string` | `""` | conditional |
356-
| client_secret | Client secret from your provider. | `string` | `""` | conditional |
357-
| client_secret_arn | Secrets manager ARN where the client id and secret can be found. | `string` | `""` | conditional |
349+
| Name | Description | Type | Default | Required |
350+
| ---------------------- | ---------------------------------------------------------------- | -------- | ---------- | ----------- |
351+
| authorization_endpoint | Authorization endpoint from your provider. | `string` | n/a | yes |
352+
| issuer | Issuer endpoint from your provider. | `string` | n/a | yes |
353+
| token_endpoint | Token endpoint from your provider. | `string` | n/a | yes |
354+
| user_info_endpoint | User info endpoint from your provider. | `string` | n/a | yes |
355+
| client_id | Client ID from your provider. | `string` | `""` | conditional |
356+
| client_secret | Client secret from your provider. | `string` | `""` | conditional |
357+
| client_secret_arn | Secrets manager ARN where the client id and secret can be found. | `string` | `""` | conditional |
358+
| scope | User claim scope to request. | `string` | `"openid"` | no |
358359

359360
### secrets_manager_secrets
360361

@@ -376,7 +377,7 @@ secrets_manager_secrets = {
376377
```
377378

378379
| Name | Description | Type | Default | Required |
379-
|------------------------|--------------------------------------------------------------|----------|---------|----------|
380+
| ---------------------- | ------------------------------------------------------------ | -------- | ------- | -------- |
380381
| description | Description of the secret. | `string` | n/a | yes |
381382
| recovery_window | Number of days that a secret can be recovered after deltion. | `string` | `30` | no |
382383
| create_random_password | Creates a random password as the staring value. | `bool` | `false` | no |
@@ -398,15 +399,15 @@ volumes = {
398399
```
399400

400401
| Name | Description | Type | Default | Required |
401-
|-------|---------------------------------------------------------------------|----------|----------------|----------|
402+
| ----- | ------------------------------------------------------------------- | -------- | -------------- | -------- |
402403
| mount | Path in the container where the volume will be mounted. | `string` | n/a | yes |
403404
| name | Name of the volume. Defauls to the key from the map. | `string` | `null` | no |
404405
| type | Type of volume to create. Currently only `persistent` is supported. | `string` | `"persistent"` | no |
405406

406407
## Outputs
407408

408409
| Name | Description | Type |
409-
|----------------------------|-------------------------------------------------------------------------|----------------|
410+
| -------------------------- | ----------------------------------------------------------------------- | -------------- |
410411
| cluster_name | Name of the ECS Fargate cluster. | `string` |
411412
| docker_push | Commands to push a Docker image to the container repository. | `string` |
412413
| endpoint_security_group_id | Security group ID for the endpoint. | `string` |

‎variables.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,7 @@ variable "oidc_settings" {
287287
client_secret_arn = optional(string, null)
288288
authorization_endpoint = string
289289
issuer = string
290+
scope = optional(string, "openid")
290291
token_endpoint = string
291292
user_info_endpoint = string
292293
})

0 commit comments

Comments
 (0)