From 691f1701da4f7f3911f6d5018138f0469c451b45 Mon Sep 17 00:00:00 2001
From: Daniel Frankcom <daniel@frankcom.ca>
Date: Fri, 6 Oct 2023 10:57:18 -0700
Subject: [PATCH] fix: Only include CA thumbprint in OIDC provider list

As per #2732 and #32847, only the CA thumbprint should be included in
the OIDC provider thumbprint list.
---
 main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/main.tf b/main.tf
index 1e73c760e9..674110e256 100644
--- a/main.tf
+++ b/main.tf
@@ -232,7 +232,7 @@ resource "aws_iam_openid_connect_provider" "oidc_provider" {
   count = local.create && var.enable_irsa && !local.create_outposts_local_cluster ? 1 : 0
 
   client_id_list  = distinct(compact(concat(["sts.${local.dns_suffix}"], var.openid_connect_audiences)))
-  thumbprint_list = concat(data.tls_certificate.this[0].certificates[*].sha1_fingerprint, var.custom_oidc_thumbprints)
+  thumbprint_list = concat([data.tls_certificate.this[0].certificates[0].sha1_fingerprint], var.custom_oidc_thumbprints)
   url             = aws_eks_cluster.this[0].identity[0].oidc[0].issuer
 
   tags = merge(