fix(iam): oidc provider fetches leaf certificate thumbprint instead of root

packages/@aws-cdk/aws-eks/lib/oidc-provider.ts

@@ -41,18 +41,11 @@ export class OpenIdConnectProvider extends iam.OpenIdConnectProvider {
    * @param props Initialization properties
    */
   public constructor(scope: Construct, id: string, props: OpenIdConnectProviderProps) {
-    /**
-     * For some reason EKS isn't validating the root certificate but a intermediate certificate
-     * which is one level up in the tree. Because of the a constant thumbprint value has to be
-     * stated with this OpenID Connect provider. The certificate thumbprint is the same for all the regions.
-     */
-    const thumbprints = ['9e99a48a9960b14926bb7f3b02e22da2b0ab7280'];
 
     const clientIds = ['sts.amazonaws.com'];
 
     super(scope, id, {
       url: props.url,
-      thumbprints,
       clientIds,
     });
   }

packages/@aws-cdk/aws-eks/test/bucket-pinger/bucket-pinger.ts

@@ -1,30 +1,27 @@
-import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
 import * as lambda from '@aws-cdk/aws-lambda';
 import { CustomResource, Token, Duration } from '@aws-cdk/core';
 import * as cr from '@aws-cdk/custom-resources';
 import { Construct } from 'constructs';
 
-export interface PingerProps {
-  readonly securityGroup?: ec2.SecurityGroup;
-  readonly vpc?: ec2.IVpc;
-  readonly subnets?: ec2.ISubnet[];
+export interface BucketPingerProps {
+  readonly bucketName: string;
 }
 export class BucketPinger extends Construct {
 
   private _resource: CustomResource;
 
-  constructor(scope: Construct, id: string, props: PingerProps) {
+  constructor(scope: Construct, id: string, props: BucketPingerProps) {
     super(scope, id);
 
     const func = new lambda.Function(this, 'Function', {
       code: lambda.Code.fromAsset(`${__dirname}/function`),
       handler: 'index.handler',
       runtime: lambda.Runtime.PYTHON_3_9,
-      vpc: props.vpc,
-      vpcSubnets: props.subnets ? { subnets: props.subnets } : undefined,
-      securityGroups: props.securityGroup ? [props.securityGroup] : undefined,
       timeout: Duration.minutes(1),
+      environment: {
+        BUCKET_NAME: props.bucketName,
+      },
     });
 
     if (!func.role) {
@@ -33,7 +30,7 @@ export class BucketPinger extends Construct {
 
     func.role.addToPrincipalPolicy(new iam.PolicyStatement({
       actions: ['s3:DeleteBucket', 's3:ListBucket'],
-      resources: ['arn:aws:s3:::*'],
+      resources: [`arn:aws:s3:::${props.bucketName}`],
     }));
 
     const provider = new cr.Provider(this, 'Provider', {

packages/@aws-cdk/aws-eks/test/bucket-pinger/function/index.py

@@ -1,6 +1,8 @@
 import json
 import logging
 import boto3
+import time
+import os
 
 logger = logging.getLogger()
 logger.setLevel(logging.INFO)
@@ -11,17 +13,19 @@ def handler(event, context):
   request_type = event['RequestType']
   props = event['ResourceProperties']
 
-  s3_bucket_name = 'amazingly-made-sdk-call-created-eks-bucket'
+  s3_bucket_name = os.environ['BUCKET_NAME']
   s3 = boto3.client('s3')
 
   if request_type in ['Create', 'Update']:
     logger.info(f'making sdk call to check if bucket with name {s3_bucket_name} exists')
+    while (True): # lambda will eventually time this out in case of consistent failures
+      try:
+        s3.head_bucket(Bucket=s3_bucket_name)
+        return {'Data': {'Value': f'confirmed that bucket with name {s3_bucket_name} exists' }}
+      except Exception as error:
+        logger.error(f'failed to head bucket with error: {str(error)}')
+        time.sleep(5)
 
-    try:
-      s3.head_bucket(Bucket=s3_bucket_name)
-    except Exception as error:
-      raise RuntimeError(f'failed to head bucket with error: {str(error)}')
-    return {'Data': {'Value': f'confirmed that bucket with name {s3_bucket_name} exists' }}
 
   elif request_type == 'Delete':
     logger.info(f'making sdk call to delete bucket with name {s3_bucket_name}')

packages/@aws-cdk/aws-eks/test/cluster.test.ts

@@ -2156,9 +2156,6 @@ describe('cluster', () => {
         ClientIDList: [
           'sts.amazonaws.com',
         ],
-        ThumbprintList: [
-          '9e99a48a9960b14926bb7f3b02e22da2b0ab7280',
-        ],
         Url: {
           'Fn::GetAtt': [
             'Cluster9EE0221C',