oidc-on-aws-alb with aws cdk (python)

alb-oidc.py

from aws_cdk import (
    core,
    aws_elasticloadbalancingv2 as elbv2,
    aws_secretsmanager as sm
)

[...]

secret_bundle = sm.Secret.from_secret_arn(
    self,
    "data_secret_bundle",
    "arn:aws:secretsmanager:eu-west-1:accountid:secret:/app/myapp/client_bundle"
)
client_id = core.SecretValue.secrets_manager(
    secret_id=secret_bundle.secret_arn,
    json_field='client_id').to_string()

client_secret = core.SecretValue.secrets_manager(
    secret_id=secret_bundle.secret_arn,
    json_field='client_secret')

[...]

https_listener.add_action(
    "default_auth_action",
    action=elbv2.ListenerAction.authenticate_oidc(
        authorization_endpoint="https://login.microsoftonline.com/zzz",
        client_id=client_id,
        client_secret=client_secret,
        [...]
        next=elbv2.ListenerAction.forward([tg])
    )
)