# IdentityPoolRoleMapping

Map roles to users in the Identity Pool based on claims from the Identity Provider.

- Source: [`aws-cognito-identitypool/lib/identitypool.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-cognito-identitypool/lib/identitypool.ts#L282)
- Type last changed: v2.186.0 · 27 Mar 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_cognito_identitypool as cognito_identitypool } from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';

declare const identityPoolProviderUrl: cognito_identitypool.IdentityPoolProviderUrl;
declare const role: iam.Role;
const identityPoolRoleMapping: cognito_identitypool.IdentityPoolRoleMapping = {
  providerUrl: identityPoolProviderUrl,

  // the properties below are optional
  mappingKey: 'mappingKey',
  resolveAmbiguousRoles: false,
  rules: [{
    claim: 'claim',
    claimValue: 'claimValue',
    mappedRole: role,

    // the properties below are optional
    matchType: cognito_identitypool.RoleMappingMatchType.EQUALS,
  }],
  useToken: false,
};
```

## Properties

- `mappingKey`: string — The key used for the role mapping in the role mapping hash.

  **Default:** The provided providerUrl

  Required if the providerUrl is a token.

- `providerUrl`: [IdentityPoolProviderUrl](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito_identitypool.IdentityPoolProviderUrl.html) (required) — The url of the Provider for which the role is mapped.

- `resolveAmbiguousRoles`: boolean — Allow for role assumption when results of role mapping are ambiguous.

  **Default:** false - Ambiguous role resolutions will lead to requester being denied

- `rules`: [RoleMappingRule](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito_identitypool.RoleMappingRule.html)[] — The claim and value that must be matched in order to assume the role.

  **Default:** No role mapping rule

  Required if useToken is false

- `useToken`: boolean = false — If true then mapped roles must be passed through the cognito:roles or cognito:preferred_role claims from Identity Provider.