Package software.amazon.awscdk.cfnpropertymixins.services.verifiedpermissions

Class CfnIdentitySourcePropsMixin

java.lang.Object
software.amazon.jsii.JsiiObject
software.amazon.awscdk.Mixin
software.amazon.awscdk.cfnpropertymixins.services.verifiedpermissions.CfnIdentitySourcePropsMixin
All Implemented Interfaces:
software.amazon.jsii.JsiiSerializable, software.constructs.IMixin
@Generated(value="jsii-pacmak/1.127.0 (build 2117ad5)", date="2026-03-11T13:20:05.908Z") @Stability(Stable) public class CfnIdentitySourcePropsMixin extends Mixin implements software.constructs.IMixin
Creates or updates a reference to Amazon Cognito as an external identity provider.

If you are creating a new identity source, then you must specify a Configuration . If you are updating an existing identity source, then you must specify an UpdateConfiguration .

After you create an identity source, you can use the identities provided by the IdP as proxies for the principal in authorization queries that use the IsAuthorizedWithToken operation. These identities take the form of tokens that contain claims about the user, such as IDs, attributes and group memberships. Amazon Cognito provides both identity tokens and access tokens, and Verified Permissions can use either or both. Any combination of identity and access tokens results in the same Cedar principal. Verified Permissions automatically translates the information about the identities into the standard Cedar attributes that can be evaluated by your policies. Because the Amazon Cognito identity and access tokens can contain different information, the tokens you choose to use determine the attributes that are available to access in the Cedar principal from your policies.

Amazon Cognito Identity is not available in all of the same AWS Regions as . Because of this, the AWS::VerifiedPermissions::IdentitySource type is not available to create from CloudFormation in Regions where Amazon Cognito Identity is not currently available. Users can still create AWS::VerifiedPermissions::IdentitySource in those Regions, but only from the AWS CLI , SDK, or from the AWS console.

To reference a user from this identity source in your Cedar policies, use the following syntax.

IdentityType::"|

Where IdentityType is the string that you provide to the PrincipalEntityType parameter for this operation. The CognitoUserPoolId and CognitoClientId are defined by the Amazon Cognito user pool.

Example: 

 // The code below shows an example of how to instantiate this type.
 // The values are placeholders you should change.
 import software.amazon.awscdk.cfnpropertymixins.services.verifiedpermissions.*;
 import software.amazon.awscdk.*;
 IMergeStrategy mergeStrategy;
 CfnIdentitySourcePropsMixin cfnIdentitySourcePropsMixin = CfnIdentitySourcePropsMixin.Builder.create(CfnIdentitySourceMixinProps.builder()
         .configuration(IdentitySourceConfigurationProperty.builder()
                 .cognitoUserPoolConfiguration(CognitoUserPoolConfigurationProperty.builder()
                         .clientIds(List.of("clientIds"))
                         .groupConfiguration(CognitoGroupConfigurationProperty.builder()
                                 .groupEntityType("groupEntityType")
                                 .build())
                         .userPoolArn("userPoolArn")
                         .build())
                 .openIdConnectConfiguration(OpenIdConnectConfigurationProperty.builder()
                         .entityIdPrefix("entityIdPrefix")
                         .groupConfiguration(OpenIdConnectGroupConfigurationProperty.builder()
                                 .groupClaim("groupClaim")
                                 .groupEntityType("groupEntityType")
                                 .build())
                         .issuer("issuer")
                         .tokenSelection(OpenIdConnectTokenSelectionProperty.builder()
                                 .accessTokenOnly(OpenIdConnectAccessTokenConfigurationProperty.builder()
                                         .audiences(List.of("audiences"))
                                         .principalIdClaim("principalIdClaim")
                                         .build())
                                 .identityTokenOnly(OpenIdConnectIdentityTokenConfigurationProperty.builder()
                                         .clientIds(List.of("clientIds"))
                                         .principalIdClaim("principalIdClaim")
                                         .build())
                                 .build())
                         .build())
                 .build())
         .policyStoreId("policyStoreId")
         .principalEntityType("principalEntityType")
         .build())
 .strategy(mergeStrategy)
 .build();

See Also:

  • Field Details

    • CFN_PROPERTY_KEYS

      @Stability(Stable) protected static final List<String> CFN_PROPERTY_KEYS

  • Constructor Details

    • CfnIdentitySourcePropsMixin

      protected CfnIdentitySourcePropsMixin(software.amazon.jsii.JsiiObjectRef objRef)

    • CfnIdentitySourcePropsMixin

      protected CfnIdentitySourcePropsMixin(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • CfnIdentitySourcePropsMixin

      @Stability(Stable) public CfnIdentitySourcePropsMixin(@NotNull CfnIdentitySourceMixinProps props, @Nullable CfnPropertyMixinOptions options)
      Create a mixin to apply properties to AWS::VerifiedPermissions::IdentitySource.

      Parameters:
      props - L1 properties to apply. This parameter is required.
      options - Mixin options.

    • CfnIdentitySourcePropsMixin

      @Stability(Stable) public CfnIdentitySourcePropsMixin(@NotNull CfnIdentitySourceMixinProps props)
      Create a mixin to apply properties to AWS::VerifiedPermissions::IdentitySource.

      Parameters:
      props - L1 properties to apply. This parameter is required.

  • Method Details

    • applyTo

      @Stability(Stable) public void applyTo(@NotNull software.constructs.IConstruct construct)
      Apply the mixin properties to the construct.

      Specified by:
      applyTo in interface software.constructs.IMixin
      Specified by:
      applyTo in class Mixin
      Parameters:
      construct - This parameter is required.

    • supports

      @Stability(Stable) @NotNull public Boolean supports(@NotNull software.constructs.IConstruct construct)
      Check if this mixin supports the given construct.

      Specified by:
      supports in interface software.constructs.IMixin
      Overrides:
      supports in class Mixin
      Parameters:
      construct - This parameter is required.

    • getProps

      @Stability(Stable) @NotNull protected CfnIdentitySourceMixinProps getProps()

    • getStrategy

      @Stability(Stable) @NotNull protected IMergeStrategy getStrategy()