identity_sources

Creates, updates, deletes, gets or lists an identity_sources resource.

Overview

Name	`identity_sources`
Type	Resource
Id	`aws.verifiedpermissions.identity_sources`

Fields

The following fields are returned by SELECT queries:

get_identity_source
list_identity_sources

Name	Datatype	Description
`configuration`	`object`	Contains configuration information about an identity source.
`created_date`	`string (date-time)`	The date and time that the identity source was originally created.
`details`	`object`	A structure that describes the configuration of the identity source.
`identity_source_id`	`string`	The ID of the identity source. (pattern: <code>[a-zA-Z0-9-]*</code>)
`last_updated_date`	`string (date-time)`	The date and time that the identity source was most recently updated.
`policy_store_id`	`string`	The ID of the policy store that contains the identity source. (pattern: <code>[a-zA-Z0-9-/_]*</code>)
`principal_entity_type`	`string`	The data type of principals generated for identities authenticated by this identity source. (pattern: <code>.*</code>)

Name	Datatype	Description
`configuration`	`object`	Contains configuration information about an identity source.
`created_date`	`string (date-time)`	The date and time the identity source was originally created.
`details`	`object`	A structure that contains the details of the associated identity provider (IdP).
`identity_source_id`	`string`	The unique identifier of the identity source. (pattern: <code>[a-zA-Z0-9-]*</code>)
`last_updated_date`	`string (date-time)`	The date and time the identity source was most recently updated.
`policy_store_id`	`string`	The identifier of the policy store that contains the identity source. (pattern: <code>[a-zA-Z0-9-/_]*</code>)
`principal_entity_type`	`string`	The Cedar entity type of the principals returned from the IdP associated with this identity source. (pattern: <code>.*</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Description
`get_identity_source`	`select`	`region`	Retrieves the details about the specified identity source.
`list_identity_sources`	`select`	`region`	Returns a paginated list of all of the identity sources defined in the specified policy store.
`create_identity_source`	`insert`	`region`, `policyStoreId`, `configuration`	Adds an identity source to a policy store–an Amazon Cognito user pool or OpenID Connect (OIDC) identity provider (IdP). After you create an identity source, you can use the identities provided by the IdP as proxies for the principal in authorization queries that use the IsAuthorizedWithToken or BatchIsAuthorizedWithToken API operations. These identities take the form of tokens that contain claims about the user, such as IDs, attributes and group memberships. Identity sources provide identity (ID) tokens and access tokens. Verified Permissions derives information about your user and session from token claims. Access tokens provide action context to your policies, and ID tokens provide principal Attributes. Tokens from an identity source user continue to be usable until they expire. Token revocation and resource deletion have no effect on the validity of a token in your policy store To reference a user from this identity source in your Cedar policies, refer to the following syntax examples. Amazon Cognito user pool: Namespace::[Entity type]::[User pool ID]\|[user principal attribute], for example MyCorp::User::us-east-1_EXAMPLE\|a1b2c3d4-5678-90ab-cdef-EXAMPLE11111. OpenID Connect (OIDC) provider: Namespace::[Entity type]::[entityIdPrefix]\|[user principal attribute], for example MyCorp::User::MyOIDCProvider\|a1b2c3d4-5678-90ab-cdef-EXAMPLE22222. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.
`update_identity_source`	`update`	`region`, `policyStoreId`, `identitySourceId`, `updateConfiguration`	Updates the specified identity source to use a new identity provider (IdP), or to change the mapping of identities from the IdP to a different principal entity type. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.
`delete_identity_source`	`delete`	`region`	Deletes an identity source that references an identity provider (IdP) such as Amazon Cognito. After you delete the identity source, you can no longer use tokens for identities from that identity source to represent principals in authorization queries made using IsAuthorizedWithToken. operations.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`region`	`string`	AWS region (default: us-east-1)

`SELECT` examples

get_identity_source
list_identity_sources

Retrieves the details about the specified identity source.

SELECT
configuration,
created_date,
details,
identity_source_id,
last_updated_date,
policy_store_id,
principal_entity_type
FROM aws.verifiedpermissions.identity_sources
WHERE region = '{{ region }}' -- required
;

Returns a paginated list of all of the identity sources defined in the specified policy store.

SELECT
configuration,
created_date,
details,
identity_source_id,
last_updated_date,
policy_store_id,
principal_entity_type
FROM aws.verifiedpermissions.identity_sources
WHERE region = '{{ region }}' -- required
;

`INSERT` examples

create_identity_source
Manifest

Adds an identity source to a policy store–an Amazon Cognito user pool or OpenID Connect (OIDC) identity provider (IdP). After you create an identity source, you can use the identities provided by the IdP as proxies for the principal in authorization queries that use the IsAuthorizedWithToken or BatchIsAuthorizedWithToken API operations. These identities take the form of tokens that contain claims about the user, such as IDs, attributes and group memberships. Identity sources provide identity (ID) tokens and access tokens. Verified Permissions derives information about your user and session from token claims. Access tokens provide action context to your policies, and ID tokens provide principal Attributes. Tokens from an identity source user continue to be usable until they expire. Token revocation and resource deletion have no effect on the validity of a token in your policy store To reference a user from this identity source in your Cedar policies, refer to the following syntax examples. Amazon Cognito user pool: Namespace::[Entity type]::[User pool ID]|[user principal attribute], for example MyCorp::User::us-east-1_EXAMPLE|a1b2c3d4-5678-90ab-cdef-EXAMPLE11111. OpenID Connect (OIDC) provider: Namespace::[Entity type]::[entityIdPrefix]|[user principal attribute], for example MyCorp::User::MyOIDCProvider|a1b2c3d4-5678-90ab-cdef-EXAMPLE22222. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.

INSERT INTO aws.verifiedpermissions.identity_sources (
clientToken,
policyStoreId,
configuration,
principalEntityType,
region
)
SELECT 
'{{ clientToken }}',
'{{ policyStoreId }}' /* required */,
'{{ configuration }}' /* required */,
'{{ principalEntityType }}',
'{{ region }}'
RETURNING
created_date,
identity_source_id,
last_updated_date,
policy_store_id
;

# Description fields are for documentation purposes
- name: identity_sources
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the identity_sources resource.
  - name: clientToken
    value: "{{ clientToken }}"
    description: |
      Specifies a unique, case-sensitive ID that you provide to ensure the idempotency of the request. This lets you safely retry the request without accidentally performing the same operation a second time. Passing the same value to a later call to an operation requires that you also pass the same value for all other parameters. We recommend that you use a UUID type of value.. If you don't provide this value, then Amazon Web Services generates a random one for you. If you retry the operation with the same ClientToken, but with different parameters, the retry fails with an ConflictException error. Verified Permissions recognizes a ClientToken for eight hours. After eight hours, the next request with the same parameters performs the operation again regardless of the value of ClientToken.
  - name: policyStoreId
    value: "{{ policyStoreId }}"
    description: |
      Specifies the ID of the policy store in which you want to store this identity source. Only policies and requests made using this policy store can reference identities from the identity provider configured in the new identity source. To specify a policy store, use its ID or alias name. When using an alias name, prefix it with policy-store-alias/. For example: ID: PSEXAMPLEabcdefg111111 Alias name: policy-store-alias/example-policy-store To view aliases, use ListPolicyStoreAliases.
  - name: configuration
    description: |
      Specifies the details required to communicate with the identity provider (IdP) associated with this identity source.
    value:
      cognitoUserPoolConfiguration:
        userPoolArn: "{{ userPoolArn }}"
        clientIds:
          - "{{ clientIds }}"
        groupConfiguration:
          groupEntityType: "{{ groupEntityType }}"
      openIdConnectConfiguration:
        issuer: "{{ issuer }}"
        entityIdPrefix: "{{ entityIdPrefix }}"
        groupConfiguration:
          groupClaim: "{{ groupClaim }}"
          groupEntityType: "{{ groupEntityType }}"
        tokenSelection:
          accessTokenOnly:
            principalIdClaim: "{{ principalIdClaim }}"
            audiences:
              - "{{ audiences }}"
          identityTokenOnly:
            principalIdClaim: "{{ principalIdClaim }}"
            clientIds:
              - "{{ clientIds }}"
  - name: principalEntityType
    value: "{{ principalEntityType }}"
    description: |
      Specifies the namespace and data type of the principals generated for identities authenticated by the new identity source.

`UPDATE` examples

update_identity_source

Updates the specified identity source to use a new identity provider (IdP), or to change the mapping of identities from the IdP to a different principal entity type. Verified Permissions is eventually consistent . It can take a few seconds for a new or changed element to propagate through the service and be visible in the results of other Verified Permissions operations.

UPDATE aws.verifiedpermissions.identity_sources
SET 
policyStoreId = '{{ policyStoreId }}',
identitySourceId = '{{ identitySourceId }}',
updateConfiguration = '{{ updateConfiguration }}',
principalEntityType = '{{ principalEntityType }}'
WHERE 
region = '{{ region }}' --required
AND policyStoreId = '{{ policyStoreId }}' --required
AND identitySourceId = '{{ identitySourceId }}' --required
AND updateConfiguration = '{{ updateConfiguration }}' --required
RETURNING
created_date,
identity_source_id,
last_updated_date,
policy_store_id;

`DELETE` examples

delete_identity_source

Deletes an identity source that references an identity provider (IdP) such as Amazon Cognito. After you delete the identity source, you can no longer use tokens for identities from that identity source to represent principals in authorization queries made using IsAuthorizedWithToken. operations.

DELETE FROM aws.verifiedpermissions.identity_sources
WHERE region = '{{ region }}' --required
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​