AWS ALB OIDC Google authentication

alb.tf

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.frontend.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = "TODO-CERT-ARN"

  default_action {
    type = "authenticate-oidc"
    authenticate_oidc {
      authorization_endpoint              = "https://accounts.google.com/o/oauth2/v2/auth"
      client_id                           = jsondecode(data.aws_secretsmanager_secret_version.google.secret_string)["client_id"]
      client_secret                       = jsondecode(data.aws_secretsmanager_secret_version.google.secret_string)["client_secret"]
      issuer                              = "https://accounts.google.com"
      token_endpoint                      = "https://oauth2.googleapis.com/token"
      user_info_endpoint                  = "https://www.googleapis.com/oauth2/v3/userinfo"
      session_cookie_name                 = "AWSELBAuthSessionCookie"
      session_timeout                     = "84600"
      scope                               = "https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email"
      on_unauthenticated_request          = "authenticate"
      authentication_request_extra_params = { "hosted_domain" = "mydomain.com" }
    }
  }

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.http.arn
  }
    
  
resource "aws_secretsmanager_secret" "google" {
  name = "/grafana/google"
}

data "aws_secretsmanager_secret_version" "google" {
  secret_id = aws_secretsmanager_secret.google.id
}