{"id":33235906,"url":"https://github.com/easy-oidc/terraform-aws-easy-oidc","last_synced_at":"2026-05-14T22:03:47.616Z","repository":{"id":322908245,"uuid":"1089243594","full_name":"easy-oidc/terraform-aws-easy-oidc","owner":"easy-oidc","description":"Terraform module for deploying Easy OIDC on AWS. Easy OIDC is an Open Source OIDC server written in Go.","archived":false,"fork":false,"pushed_at":"2025-11-07T00:37:56.000Z","size":15,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-11-07T02:28:48.368Z","etag":null,"topics":["kubernetes","oauth2","oidc","oidc-server","terraform"],"latest_commit_sha":null,"homepage":"https://easy-oidc.dev","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/easy-oidc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-04T04:40:23.000Z","updated_at":"2025-11-07T00:37:45.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/easy-oidc/terraform-aws-easy-oidc","commit_stats":null,"previous_names":["easy-oidc/terraform-aws-easy-oidc"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/easy-oidc/terraform-aws-easy-oidc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/easy-oidc%2Fterraform-aws-easy-oidc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/easy-oidc%2Fterraform-aws-easy-oidc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/easy-oidc%2Fterraform-aws-easy-oidc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/easy-oidc%2Fterraform-aws-easy-oidc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/easy-oidc","download_url":"https://codeload.github.com/easy-oidc/terraform-aws-easy-oidc/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/easy-oidc%2Fterraform-aws-easy-oidc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":284750955,"owners_count":27057456,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-11-16T02:00:05.974Z","response_time":65,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kubernetes","oauth2","oidc","oidc-server","terraform"],"created_at":"2025-11-16T18:01:47.803Z","updated_at":"2025-11-16T18:02:59.695Z","avatar_url":"https://github.com/easy-oidc.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-aws-easy-oidc\n\nTerraform module for deploying [easy-oidc](https://github.com/easy-oidc/easy-oidc) on AWS.\n\nProvisions a minimal OIDC server designed for use with Kubernetes, with Google/GitHub/Generic federation, and support for static group overrides.\n\n## Features\n\n- **Single EC2 instance** deployment (ARM64, t4g.nano by default)\n- **Dual-stack IPv4/IPv6** or IPv6-only support\n- **Auto-subnet creation** if no subnet id is specified\n- **Caddy reverse proxy** with automatic Let's Encrypt TLS (requires DNS to be configured on hostname)\n- **AWS Secrets Manager** for storing signing keys and OAuth credentials\n- **Static group mappings** for Kubernetes RBAC\n\n## Prerequisites\n\nCreate secrets in AWS Secrets Manager before deploying:\n\n### 1. OAuth Client Credentials\n\n**For Google:**\n```bash\naws secretsmanager create-secret \\\n  --name easy-oidc-connector-secret \\\n  --secret-string '{\n    \"client_id\": \"123456789.apps.googleusercontent.com\",\n    \"client_secret\": \"GOCSPX-xxxxxxxxxxxxxxxxxxxxx\"\n  }'\n```\n\n**For GitHub:**\n```bash\naws secretsmanager create-secret \\\n  --name easy-oidc-connector-secret \\\n  --secret-string '{\n    \"client_id\": \"Iv1.abc123def456\",\n    \"client_secret\": \"abc123def456...\"\n  }'\n```\n\n### 2. Signing Key (Ed25519)\n\n```bash\nopenssl genpkey -algorithm ed25519 | aws secretsmanager create-secret \\\n  --name easy-oidc-signing-key \\\n  --secret-string file:///dev/stdin\n```\n\n## Usage\n\n```hcl\n# Configuration\nlocals {\n  vpc_cidr      = \"10.0.0.0/16\"\n  oidc_hostname = \"auth.example.com\"\n}\n\n# Reference secrets\ndata \"aws_secretsmanager_secret\" \"connector_secret\" {\n  name = \"easy-oidc-connector-secret\"\n}\ndata \"aws_secretsmanager_secret\" \"signing_key\" {\n  name = \"easy-oidc-signing-key\"\n}\n\n# Create VPC with dual-stack networking\nresource \"aws_vpc\" \"main\" {\n  cidr_block                       = local.vpc_cidr\n  assign_generated_ipv6_cidr_block = true\n  enable_dns_hostnames             = true\n  enable_dns_support               = true\n}\nresource \"aws_internet_gateway\" \"main\" {\n  vpc_id = aws_vpc.main.id\n}\nresource \"aws_route_table\" \"main\" {\n  vpc_id = aws_vpc.main.id\n  route {\n    cidr_block = \"0.0.0.0/0\"\n    gateway_id = aws_internet_gateway.main.id\n  }\n  route {\n    ipv6_cidr_block = \"::/0\"\n    gateway_id      = aws_internet_gateway.main.id\n  }\n}\n\n# Deploy easy-oidc\nmodule \"easy_oidc\" {\n  source = \"easy-oidc/easy-oidc/aws\"\n\n  vpc_id                        = aws_vpc.main.id\n  oidc_addr                     = local.oidc_hostname\n  connector_type                = \"google\"\n  connector_client_secret_arn   = data.aws_secretsmanager_secret.connector_secret.arn\n  signing_key_secret_arn        = data.aws_secretsmanager_secret.signing_key.arn\n  default_redirect_uris = [\"http://localhost:8000\"]\n  groups_overrides = {\n    prod-groups = {\n      \"alice@example.com\" = [\"prod-admins\", \"devs\"]\n      \"bob@example.com\"   = [\"prod-readonly\"]\n    }\n  }\n  clients = {\n    kubelogin-prod = {\n      groups_override = \"prod-groups\"\n    }\n    kubelogin-dev = {\n      # Uses default_redirect_uris and upstream IdP groups\n    }\n  }\n}\n\n# Configure DNS records\ndata \"aws_route53_zone\" \"main\" {\n  name = \"example.com\"\n}\nresource \"aws_route53_record\" \"oidc_a\" {\n  count   = module.easy_oidc.instance_public_ipv4 != null ? 1 : 0\n  zone_id = data.aws_route53_zone.main.zone_id\n  name    = local.oidc_hostname\n  type    = \"A\"\n  ttl     = 300\n  records = [module.easy_oidc.instance_public_ipv4]\n}\nresource \"aws_route53_record\" \"oidc_aaaa\" {\n  zone_id = data.aws_route53_zone.main.zone_id\n  name    = local.oidc_hostname\n  type    = \"AAAA\"\n  ttl     = 300\n  records = [module.easy_oidc.instance_public_ipv6]\n}\n```\n\n## Kubernetes Integration\n\n### API Server Flags\n\n```bash\n--oidc-issuer-url=https://auth.example.com\n--oidc-client-id=kubelogin-prod\n--oidc-username-claim=email\n--oidc-groups-claim=groups\n```\n\n### kubeconfig Example\n\nYou can auth kubectl using [kubelogin](https://github.com/int128/kubelogin).\n\nExample kubeconfig:\n\n```yaml\nusers:\n  - name: oidc-prod\n    user:\n      exec:\n        apiVersion: client.authentication.k8s.io/v1\n        command: kubelogin\n        args:\n          - get-token\n          - --oidc-issuer-url=https://auth.example.com\n          - --oidc-client-id=kubelogin-prod\n          - --oidc-use-pkce\n```\n\nor test with:\n\n```bash\nkubectl oidc-login setup \\\n    --oidc-issuer-url=https://auth.example.com \\\n    --oidc-client-id=kubelogin-prod \\\n    --oidc-use-pkce\n```\n\n## IPv6-Only Deployment\n\n```hcl\nmodule \"easy_oidc\" {\n  source = \"easy-oidc/easy-oidc/aws\"\n\n  vpc_id = aws_vpc.main.id\n  # ... other variables ...\n  \n  enable_ipv4 = false\n}\n```\n\n## Variables\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|----------|\n| name_prefix | Prefix for resource names | `string` | `\"easy-oidc\"` | no |\n| tags | Additional tags to apply to all resources | `map(string)` | `{}` | no |\n| vpc_id | VPC ID | `string` | - | yes |\n| oidc_addr | OIDC server address | `string` | - | yes |\n| connector_type | Upstream IdP: `google` or `github` | `string` | - | yes |\n| connector_client_secret_arn | Secrets Manager ARN for OAuth credentials | `string` | - | yes |\n| clients | Map of OIDC client configurations | `map(object)` | - | yes |\n| subnet_id | Subnet ID (auto-created if omitted) | `string` | `null` | no |\n| signing_key_secret_arn | Secrets Manager ARN for signing key | `string` | `null` | no |\n| default_redirect_uris | Default redirect URIs | `list(string)` | `[\"http://localhost:8000\"]` | no |\n| groups_overrides | Group override mappings | `map(map(list(string)))` | `{}` | no |\n| enable_ipv4 | Enable IPv4 support | `bool` | `true` | no |\n| instance_type | EC2 instance type | `string` | `\"t4g.nano\"` | no |\n| allowed_cidrs_ipv4 | Allowed IPv4 CIDRs | `list(string)` | `[\"0.0.0.0/0\"]` | no |\n| allowed_cidrs_ipv6 | Allowed IPv6 CIDRs | `list(string)` | `[\"::/0\"]` | no |\n| connector_hosted_domain | Google hosted domain | `string` | `null` | no |\n| connector_github_hostname | GitHub hostname for GHE | `string` | `\"github.com\"` | no |\n| easy_oidc_version | easy-oidc version to install | `string` | `\"latest\"` | no |\n| caddy_version | Caddy version | `string` | `\"latest\"` | no |\n| kms_key_id | KMS key ID/ARN for EBS encryption (uses AWS managed key if not specified) | `string` | `null` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| issuer_url | OIDC issuer URL |\n| client_ids | List of configured client IDs |\n| instance_id | EC2 instance ID |\n| instance_public_ipv4 | Public IPv4 address (null if disabled) |\n| instance_public_ipv6 | Public IPv6 address |\n| subnet_id | Subnet ID |\n| security_group_id | Security group ID |\n\n## Resources Created\n\n- **EC2 Instance**: ARM64 (t4g.nano), Ubuntu 22.04 LTS\n- **Subnet** (optional): Auto-created with dual-stack support\n- **Security Group**: Allows HTTP/HTTPS from configured CIDRs\n- **IAM Role**: Read-only access to Secrets Manager\n- **IAM Instance Profile**: Attached to EC2 instance\n\n## Security\n\n- All secrets stored in AWS Secrets Manager (never in Terraform state)\n- EC2 IAM role has read-only access to specified secrets\n- Caddy provides automatic HTTPS with Let's Encrypt\n- PKCE enforcement for all OAuth flows\n- SQLite database stored at `/var/lib/easy-oidc` for auth code and state storage\n\n## License\n\nEasy OIDC is licensed under the Apache License, Version 2.0.\nCopyright 2025 Nadrama Pty Ltd.\nSee the [LICENSE](./LICENSE) file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feasy-oidc%2Fterraform-aws-easy-oidc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feasy-oidc%2Fterraform-aws-easy-oidc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feasy-oidc%2Fterraform-aws-easy-oidc/lists"}