load-balancer-role-trust-policy.tftpl

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::${account_id}:oidc-provider/${oidc_provider}"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "${oidc_provider}:aud": "sts.amazonaws.com",
                    "${oidc_provider}:sub": "system:serviceaccount:${namespace}:${service_account_name}"
                }
            }
        }
    ]
}