aws_iam_oidc_provider resource

Use the aws_iam_oidc_provider InSpec audit resource to test properties of a single IAM OpenID Connect (OIDC) provider.

This resource retrieves information about the specified OIDC provider.

For additional information, including details on parameters and properties, see the AWS documentation on IAM OIDC provider.

Syntax

Ensure that an OIDC provider exists.

describe aws_iam_oidc_provider(open_id_connect_provider_arn: 'OIDC_PROVIDER_ARN') do
  it { should exist }
end

open_id_connect_provider_arn (required): The Amazon Resource Name (ARN) of the OIDC provider resource object in IAM to get information for.

url: The URL that the IAM OIDC provider resource object is associated with.
create_date: The date and time when the IAM OIDC provider resource object was created in the account.
tags: A list of tags that are attached to the specified IAM OIDC provider.

Ensure an URL is available:

describe aws_iam_oidc_provider(open_id_connect_provider_arn: 'OIDC_PROVIDER_ARN') do
  its('url') { should eq 'example.com' }
end

Ensure that tags are available:

describe aws_iam_oidc_provider(open_id_connect_provider_arn: 'OIDC_PROVIDER_ARN') do
    its('tags') { should eq ':TAG => 'TAG_VALUE' }
end

For a full list of available matchers, see our Universal Matchers page.

This resource has the following special matchers.

Use should to test that the entity exists.

describe aws_iam_oidc_provider(open_id_connect_provider_arn: 'OIDC_PROVIDER_ARN') do
  it { should exist }
end

Use should_not to test the entity does not exist.

describe aws_iam_oidc_provider(open_id_connect_provider_arn: 'OIDC_PROVIDER_ARN') do
  it { should_not exist }
end

Use should to check if the entity is available.

describe aws_iam_oidc_provider(open_id_connect_provider_arn: 'OIDC_PROVIDER_ARN') do
  it { should be_available }
end

Your AWS principal will need the IAM:Client:GetOpenIDConnectProviderResponse action with Effect set to Allow.