pulumi-aws-kotlin/com.pulumi.aws.cognito.kotlin/ManagedUserPoolClient

ManagedUserPoolClient

class ManagedUserPoolClient : KotlinCustomResource

Use the aws.cognito.UserPoolClient resource to manage a Cognito User Pool Client. This resource is advanced and has special caveats to consider before use. Please read this document completely before using the resource. Use the aws.cognito.ManagedUserPoolClient resource to manage a Cognito User Pool Client that is automatically created by an AWS service. For instance, when configuring an OpenSearch Domain to use Cognito authentication, the OpenSearch service creates the User Pool Client during setup and removes it when it is no longer required. As a result, the aws.cognito.ManagedUserPoolClient resource does not create or delete this resource, but instead assumes management of it. Use the aws.cognito.UserPoolClient resource to manage Cognito User Pool Clients for normal use cases.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cognito.UserPool;
import com.pulumi.aws.cognito.IdentityPool;
import com.pulumi.aws.cognito.IdentityPoolArgs;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetPartitionArgs;
import com.pulumi.aws.iam.IamFunctions;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.iam.RolePolicyAttachment;
import com.pulumi.aws.iam.RolePolicyAttachmentArgs;
import com.pulumi.aws.opensearch.Domain;
import com.pulumi.aws.opensearch.DomainArgs;
import com.pulumi.aws.opensearch.inputs.DomainCognitoOptionsArgs;
import com.pulumi.aws.opensearch.inputs.DomainEbsOptionsArgs;
import com.pulumi.aws.cognito.ManagedUserPoolClient;
import com.pulumi.aws.cognito.ManagedUserPoolClientArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var exampleUserPool = new UserPool("exampleUserPool");
        var exampleIdentityPool = new IdentityPool("exampleIdentityPool", IdentityPoolArgs.builder()
            .identityPoolName("example")
            .build());
        final var current = AwsFunctions.getPartition();
        final var examplePolicyDocument = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .sid("")
                .actions("sts:AssumeRole")
                .effect("Allow")
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .type("Service")
                    .identifiers(String.format("es.%s", current.applyValue(getPartitionResult -> getPartitionResult.dnsSuffix())))
                    .build())
                .build())
            .build());
        var exampleRole = new Role("exampleRole", RoleArgs.builder()
            .path("/service-role/")
            .assumeRolePolicy(examplePolicyDocument.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json()))
            .build());
        var exampleRolePolicyAttachment = new RolePolicyAttachment("exampleRolePolicyAttachment", RolePolicyAttachmentArgs.builder()
            .role(exampleRole.name())
            .policyArn(String.format("arn:%s:iam::aws:policy/AmazonESCognitoAccess", current.applyValue(getPartitionResult -> getPartitionResult.partition())))
            .build());
        var exampleDomain = new Domain("exampleDomain", DomainArgs.builder()
            .cognitoOptions(DomainCognitoOptionsArgs.builder()
                .enabled(true)
                .userPoolId(exampleUserPool.id())
                .identityPoolId(exampleIdentityPool.id())
                .roleArn(exampleRole.arn())
                .build())
            .ebsOptions(DomainEbsOptionsArgs.builder()
                .ebsEnabled(true)
                .volumeSize(10)
                .build())
            .build(), CustomResourceOptions.builder()
                .dependsOn(
                    aws_cognito_user_pool_domain.example(),
                    exampleRolePolicyAttachment)
                .build());
        var exampleManagedUserPoolClient = new ManagedUserPoolClient("exampleManagedUserPoolClient", ManagedUserPoolClientArgs.builder()
            .namePrefix("AmazonOpenSearchService-example")
            .userPoolId(exampleUserPool.id())
            .build(), CustomResourceOptions.builder()
                .dependsOn(exampleDomain)
                .build());
    }
}

Import

Using pulumi import, import Cognito User Pool Clients using the id of the Cognito User Pool and the id of the Cognito User Pool Client. For example:

$ pulumi import aws:cognito/managedUserPoolClient:ManagedUserPoolClient client us-west-2_abc123/3ho4ek12345678909nh3fmhpko

Properties

accessTokenValidity

val accessTokenValidity: Output<Int>

Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

allowedOauthFlows

val allowedOauthFlows: Output<List<String>>

List of allowed OAuth flows, including code, implicit, and client_credentials.

allowedOauthFlowsUserPoolClient

val allowedOauthFlowsUserPoolClient: Output<Boolean>

Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

allowedOauthScopes

val allowedOauthScopes: Output<List<String>>

List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

analyticsConfiguration

val analyticsConfiguration: Output<ManagedUserPoolClientAnalyticsConfiguration>?

Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

authSessionValidity

val authSessionValidity: Output<Int>

Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

callbackUrls

val callbackUrls: Output<List<String>>

List of allowed callback URLs for the identity providers.

clientSecret

val clientSecret: Output<String>

Client secret of the user pool client.

defaultRedirectUri

val defaultRedirectUri: Output<String>

Default redirect URI and must be included in the list of callback URLs.

enablePropagateAdditionalUserContextData

val enablePropagateAdditionalUserContextData: Output<Boolean>

Enables the propagation of additional user context data.

enableTokenRevocation

val enableTokenRevocation: Output<Boolean>

Enables or disables token revocation.

explicitAuthFlows

val explicitAuthFlows: Output<List<String>>

List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

val id: Output<String>

idTokenValidity

val idTokenValidity: Output<Int>

Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

logoutUrls

val logoutUrls: Output<List<String>>

List of allowed logout URLs for the identity providers.

name

val name: Output<String>

Name of the user pool client.

namePattern

val namePattern: Output<String>?

Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

namePrefix

val namePrefix: Output<String>?

String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client. The following arguments are optional:

preventUserExistenceErrors

val preventUserExistenceErrors: Output<String>

Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

pulumiChildResources

val pulumiChildResources: Set<KotlinResource>

pulumiResourceName

val pulumiResourceName: String

pulumiResourceType

val pulumiResourceType: String

readAttributes

val readAttributes: Output<List<String>>

List of user pool attributes that the application client can read from.

refreshTokenValidity

val refreshTokenValidity: Output<Int>

Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

supportedIdentityProviders

val supportedIdentityProviders: Output<List<String>>

List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

tokenValidityUnits

val tokenValidityUnits: Output<ManagedUserPoolClientTokenValidityUnits>?

Configuration block for representing the validity times in units. See details below. Detailed below.

urn

val urn: Output<String>

userPoolId

val userPoolId: Output<String>

User pool that the client belongs to.

writeAttributes

val writeAttributes: Output<List<String>>

List of user pool attributes that the application client can write to.