Package software.amazon.awscdk.services.verifiedpermissions

Class CfnIdentitySource

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
software.amazon.awscdk.CfnElement
software.amazon.awscdk.CfnRefElement
software.amazon.awscdk.CfnResource
software.amazon.awscdk.services.verifiedpermissions.CfnIdentitySource
All Implemented Interfaces:
IInspectable, IEnvironmentAware, IIdentitySourceRef, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
@Generated(value="jsii-pacmak/1.119.0 (build 1634eac)", date="2025-12-01T16:02:31.274Z") @Stability(Stable) public class CfnIdentitySource extends CfnResource implements IInspectable, IIdentitySourceRef
Creates or updates a reference to Amazon Cognito as an external identity provider.

If you are creating a new identity source, then you must specify a Configuration . If you are updating an existing identity source, then you must specify an UpdateConfiguration .

After you create an identity source, you can use the identities provided by the IdP as proxies for the principal in authorization queries that use the IsAuthorizedWithToken operation. These identities take the form of tokens that contain claims about the user, such as IDs, attributes and group memberships. Amazon Cognito provides both identity tokens and access tokens, and Verified Permissions can use either or both. Any combination of identity and access tokens results in the same Cedar principal. Verified Permissions automatically translates the information about the identities into the standard Cedar attributes that can be evaluated by your policies. Because the Amazon Cognito identity and access tokens can contain different information, the tokens you choose to use determine the attributes that are available to access in the Cedar principal from your policies.

Amazon Cognito Identity is not available in all of the same AWS Regions as . Because of this, the AWS::VerifiedPermissions::IdentitySource type is not available to create from CloudFormation in Regions where Amazon Cognito Identity is not currently available. Users can still create AWS::VerifiedPermissions::IdentitySource in those Regions, but only from the AWS CLI , SDK, or from the AWS console.

To reference a user from this identity source in your Cedar policies, use the following syntax.

IdentityType::"|

Where IdentityType is the string that you provide to the PrincipalEntityType parameter for this operation. The CognitoUserPoolId and CognitoClientId are defined by the Amazon Cognito user pool.

Example: 

 // The code below shows an example of how to instantiate this type.
 // The values are placeholders you should change.
 import software.amazon.awscdk.services.verifiedpermissions.*;
 CfnIdentitySource cfnIdentitySource = CfnIdentitySource.Builder.create(this, "MyCfnIdentitySource")
         .configuration(IdentitySourceConfigurationProperty.builder()
                 .cognitoUserPoolConfiguration(CognitoUserPoolConfigurationProperty.builder()
                         .userPoolArn("userPoolArn")
                         // the properties below are optional
                         .clientIds(List.of("clientIds"))
                         .groupConfiguration(CognitoGroupConfigurationProperty.builder()
                                 .groupEntityType("groupEntityType")
                                 .build())
                         .build())
                 .openIdConnectConfiguration(OpenIdConnectConfigurationProperty.builder()
                         .issuer("issuer")
                         .tokenSelection(OpenIdConnectTokenSelectionProperty.builder()
                                 .accessTokenOnly(OpenIdConnectAccessTokenConfigurationProperty.builder()
                                         .audiences(List.of("audiences"))
                                         .principalIdClaim("principalIdClaim")
                                         .build())
                                 .identityTokenOnly(OpenIdConnectIdentityTokenConfigurationProperty.builder()
                                         .clientIds(List.of("clientIds"))
                                         .principalIdClaim("principalIdClaim")
                                         .build())
                                 .build())
                         // the properties below are optional
                         .entityIdPrefix("entityIdPrefix")
                         .groupConfiguration(OpenIdConnectGroupConfigurationProperty.builder()
                                 .groupClaim("groupClaim")
                                 .groupEntityType("groupEntityType")
                                 .build())
                         .build())
                 .build())
         .policyStoreId("policyStoreId")
         // the properties below are optional
         .principalEntityType("principalEntityType")
         .build();

See Also:

  • Field Details

    • CFN_RESOURCE_TYPE_NAME

      @Stability(Stable) public static final String CFN_RESOURCE_TYPE_NAME
      The CloudFormation resource type name for this resource class.

  • Constructor Details

    • CfnIdentitySource

      protected CfnIdentitySource(software.amazon.jsii.JsiiObjectRef objRef)

    • CfnIdentitySource

      protected CfnIdentitySource(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • CfnIdentitySource

      @Stability(Stable) public CfnIdentitySource(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull CfnIdentitySourceProps props)
      Create a new AWS::VerifiedPermissions::IdentitySource.

      Parameters:
      scope - Scope in which this resource is defined. This parameter is required.
      id - Construct identifier for this resource (unique in its scope). This parameter is required.
      props - Resource properties. This parameter is required.

  • Method Details

    • isCfnIdentitySource

      @Stability(Stable) @NotNull public static Boolean isCfnIdentitySource(@NotNull Object x)
      Checks whether the given object is a CfnIdentitySource.

      Parameters:
      x - This parameter is required.

    • inspect

      @Stability(Stable) public void inspect(@NotNull TreeInspector inspector)
      Examines the CloudFormation resource and discloses attributes.

      Specified by:
      inspect in interface IInspectable
      Parameters:
      inspector - tree inspector to collect and process attributes. This parameter is required.

    • renderProperties

      @Stability(Stable) @NotNull protected Map<String,Object> renderProperties(@NotNull Map<String,Object> props)
      Overrides:
      renderProperties in class CfnResource
      Parameters:
      props - This parameter is required.

    • getAttrDetails

      @Stability(Stable) @NotNull public IResolvable getAttrDetails()

    • getAttrDetailsClientIds

      @Stability(Stable) @NotNull public List<String> getAttrDetailsClientIds()

    • getAttrDetailsDiscoveryUrl

      @Stability(Stable) @NotNull public String getAttrDetailsDiscoveryUrl()

    • getAttrDetailsOpenIdIssuer

      @Stability(Stable) @NotNull public String getAttrDetailsOpenIdIssuer()

    • getAttrDetailsUserPoolArn

      @Stability(Stable) @NotNull public String getAttrDetailsUserPoolArn()

    • getAttrIdentitySourceId

      @Stability(Stable) @NotNull public String getAttrIdentitySourceId()
      The unique ID of the new or updated identity store.

    • getCfnProperties

      @Stability(Stable) @NotNull protected Map<String,Object> getCfnProperties()
      Overrides:
      getCfnProperties in class CfnResource

    • getIdentitySourceRef

      @Stability(Stable) @NotNull public IdentitySourceReference getIdentitySourceRef()
      A reference to a IdentitySource resource.
      Specified by:
      getIdentitySourceRef in interface IIdentitySourceRef

    • getConfiguration

      @Stability(Stable) @NotNull public Object getConfiguration()
      Contains configuration information used when creating a new identity source.

      Returns union: either IResolvable or CfnIdentitySource.IdentitySourceConfigurationProperty

    • setConfiguration

      @Stability(Stable) public void setConfiguration(@NotNull IResolvable value)
      Contains configuration information used when creating a new identity source.

    • setConfiguration

      @Stability(Stable) public void setConfiguration(@NotNull CfnIdentitySource.IdentitySourceConfigurationProperty value)
      Contains configuration information used when creating a new identity source.

    • getPolicyStoreId

      @Stability(Stable) @NotNull public String getPolicyStoreId()
      Specifies the ID of the policy store in which you want to store this identity source.

    • setPolicyStoreId

      @Stability(Stable) public void setPolicyStoreId(@NotNull String value)
      Specifies the ID of the policy store in which you want to store this identity source.

    • getPrincipalEntityType

      @Stability(Stable) @Nullable public String getPrincipalEntityType()
      Specifies the namespace and data type of the principals generated for identities authenticated by the new identity source.

    • setPrincipalEntityType

      @Stability(Stable) public void setPrincipalEntityType(@Nullable String value)
      Specifies the namespace and data type of the principals generated for identities authenticated by the new identity source.