Package: aws-oidc-provider-refresher
AWS Open ID Connect provider thumbprint refresherUsage: aws-oidc-provider-refresher [OPTIONS]

updates the thumbprint list of Open ID connect providers.

By default, all OIDC provider thumbprints are updated. To only update OIDC
providers which are tagged with auto-refresh=true, type:

    aws-oidc-provider-refresher --filter auto-refresh=true --force

Options:
--filter TAG                    to select providers by in the format
Name=Value.
--max-thumbprints INTEGER RANGE
to keep in the thumbprint list  [1<=x<=5]
--dry-run / --force             show what should happen or update the OIDC
providers
--verbose                       show some more detailed output
--help                          Show this message and exit.DescriptionThe AWS Open ID Connect provider is an awesome way to grant third party identities access
to your AWS account. It is very easy to configure: you only need the domain name and
the fingerprint of the certificate of the host serving the JSON Web Keys.To obtain this fingerprint Amazon wrote three pages ofdocumentation,
but it is by no means a once-in-a-lifetime event. In a previous post, we described how to set the fingerprint in aCloudFormationtemplate.
However, the Open ID connect identity providers regularly
renew their certificate. This means you have to refresh the fingerprint as well.This utility allows you to dynamically update the fingerprints of the OIDC providers. You can
do this manually or automatically when you deploy it as an AWS lambda.installto install the utility, type:pipinstallaws-oidc-provider-refresherupdate the fingerprintsTo update the fingerprints, type:$aws-oidc-provider-refresher--verbose
INFO:Foundcredentialsinsharedcredentialsfile:~/.aws/credentials
INFO:selectingallOIDCproviders
INFO:newfingerprint962828776ba4dc09a2a0a2b72ff9cd0bd8c33aeefoundofgitlab.com,subjectCN=gitlab.com,O=Cloudflare\,Inc.,L=SanFrancisco,ST=California,C=USissuedbyCN=CloudflareIncECCCA-3,O=Cloudflare\,Inc.,C=US
INFO:Wouldupdate1outof1OpenIDconnectproviders,butnochangesweremadeAs you can see the utility did not make any changes yet. To update, add--force:$aws-oidc-provider-refresher--verbose--force
INFO:Foundcredentialsinsharedcredentialsfile:~/.aws/credentials
INFO:selectingallOIDCproviders
INFO:newfingerprint962828776ba4dc09a2a0a2b72ff9cd0bd8c33aeefoundofgitlab.com,subjectCN=gitlab.com,O=Cloudflare\,Inc.,L=SanFrancisco,ST=California,C=USissuedbyCN=CloudflareIncECCCA-3,O=Cloudflare\,Inc.,C=US
INFO:found1OpenIDconnectproviders,1ofwhichwereupdated.It is as easy as that! But, the ensure that the thumbprint list is kept up-to-date we recommend
to deploy the refresher as a lambda:deploy as LambdaTo deploy the refresher as an AWS Lambda, type:gitclonehttps://github.com/binxio/aws-oidc-provider-refresher.gitcdaws-oidc-provider-refresher
awscloudformationdeploy\--capabilitiesCAPABILITY_IAM\--stack-nameaws-oidc-provider-refresher\--template-file./cloudformation/aws-oidc-provider-refresher.yamlThis will install the OIDC provider refresher in your AWS account and run every hour. To invoke
it manually type:$awslambdainvoke--function-nameaws-oidc-provider-refresher\--queryLogResult--outputtext\--payload$(base64<<<'{"verbose": true, "dry_run": false}')\--log-typeTail/dev/fd/1|\base64-dSTARTRequestId:b7f362bf-659a-4890-9b19-790a9979439fVersion:$LATEST[INFO]2022-09-17T07:49:01.058Zb7f362bf-659a-4890-9b19-790a9979439fFoundcredentialsinenvironmentvariables.[INFO]2022-09-17T07:49:02.318Zb7f362bf-659a-4890-9b19-790a9979439fselectingallOIDCproviders[INFO]2022-09-17T07:49:04.816Zb7f362bf-659a-4890-9b19-790a9979439fgitlab.comnowhas2thumbprints[INFO]2022-09-17T07:49:04.816Zb7f362bf-659a-4890-9b19-790a9979439fnewfingerprint962828776ba4dc09a2a0a2b72ff9cd0bd8c33aeefoundofgitlab.com,subjectCN=gitlab.com,O=Cloudflare\,Inc.,L=SanFrancisco,ST=California,C=USissuedbyCN=CloudflareIncECCCA-3,O=Cloudflare\,Inc.,C=US[INFO]2022-09-17T07:49:04.936Zb7f362bf-659a-4890-9b19-790a9979439ffound1OpenIDconnectproviders,1ofwhichwereupdated.

ENDRequestId:b7f362bf-659a-4890-9b19-790a9979439f
REPORTRequestId:b7f362bf-659a-4890-9b19-790a9979439fDuration:4089.85msBilledDuration:4090msMemorySize:128MBMaxMemoryUsed:90MBInitDuration:453.23ms