API version 2014-06-30 of the Amazon Cognito Identity SDK configuration.

Thrown if the identity pool has no role associated for the given auth type (auth/unauth) or if the AssumeRole fails.

Thrown for missing or bad input parameter(s).

Thrown when a user is not authorized to access the requested resource.

Thrown when the service encounters an error during processing the request.

An exception thrown when a dependent service such as Facebook or Twitter is not responding

Thrown when a request is throttled.

Thrown if there are parallel requests to modify a resource.

Thrown when a user tries to use a login which is already linked to another account.

The provided developer user identifier is already registered with Cognito under a different identity ID.

Thrown when the requested resource (for example, a dataset or record) does not exist.

Thrown when the total number of user pools has exceeded a preset limit.

A provider representing an Amazon Cognito user pool and its client ID.

See: newCognitoIdentityProvider smart constructor.

Create a value of CognitoIdentityProvider with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:clientId:CognitoIdentityProvider', cognitoIdentityProvider_clientId - The client ID for the Amazon Cognito user pool.

$sel:serverSideTokenCheck:CognitoIdentityProvider', cognitoIdentityProvider_serverSideTokenCheck - TRUE if server-side token validation is enabled for the identity provider’s token.

Once you set ServerSideTokenCheck to TRUE for an identity pool, that identity pool will check with the integrated user pools to make sure that the user has not been globally signed out or deleted before the identity pool provides an OIDC token or AWS credentials for the user.

If the user is signed out or deleted, the identity pool will return a 400 Not Authorized error.

$sel:providerName:CognitoIdentityProvider', cognitoIdentityProvider_providerName - The provider name for an Amazon Cognito user pool. For example, cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789.

The client ID for the Amazon Cognito user pool.

TRUE if server-side token validation is enabled for the identity provider’s token.

Once you set ServerSideTokenCheck to TRUE for an identity pool, that identity pool will check with the integrated user pools to make sure that the user has not been globally signed out or deleted before the identity pool provides an OIDC token or AWS credentials for the user.

If the user is signed out or deleted, the identity pool will return a 400 Not Authorized error.

The provider name for an Amazon Cognito user pool. For example, cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789.

Credentials for the provided identity ID.

See: newCredentials smart constructor.

Create a value of Credentials with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:sessionToken:Credentials', credentials_sessionToken - The Session Token portion of the credentials

$sel:expiration:Credentials', credentials_expiration - The date at which these credentials will expire.

$sel:secretKey:Credentials', credentials_secretKey - The Secret Access Key portion of the credentials

$sel:accessKeyId:Credentials', credentials_accessKeyId - The Access Key portion of the credentials.

The Session Token portion of the credentials

The date at which these credentials will expire.

The Secret Access Key portion of the credentials

The Access Key portion of the credentials.

A description of the identity.

See: newIdentityDescription smart constructor.

Create a value of IdentityDescription with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:lastModifiedDate:IdentityDescription', identityDescription_lastModifiedDate - Date on which the identity was last modified.

$sel:creationDate:IdentityDescription', identityDescription_creationDate - Date on which the identity was created.

$sel:logins:IdentityDescription', identityDescription_logins - The provider names.

$sel:identityId:IdentityDescription', identityDescription_identityId - A unique identifier in the format REGION:GUID.

Date on which the identity was last modified.

Date on which the identity was created.

The provider names.

A unique identifier in the format REGION:GUID.

An object representing an Amazon Cognito identity pool.

See: newIdentityPool smart constructor.

Create a value of IdentityPool with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:samlProviderARNs:IdentityPool', identityPool_samlProviderARNs - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.

$sel:supportedLoginProviders:IdentityPool', identityPool_supportedLoginProviders - Optional key:value pairs mapping provider names to provider app IDs.

$sel:allowClassicFlow:IdentityPool', identityPool_allowClassicFlow - Enables or disables the Basic (Classic) authentication flow. For more information, see Identity Pools (Federated Identities) Authentication Flow in the Amazon Cognito Developer Guide.

$sel:developerProviderName:IdentityPool', identityPool_developerProviderName - The "domain" by which Cognito will refer to your users.

$sel:identityPoolTags:IdentityPool', identityPool_identityPoolTags - The tags that are assigned to the identity pool. A tag is a label that you can apply to identity pools to categorize and manage them in different ways, such as by purpose, owner, environment, or other criteria.

$sel:openIdConnectProviderARNs:IdentityPool', identityPool_openIdConnectProviderARNs - The ARNs of the OpenID Connect providers.

$sel:cognitoIdentityProviders:IdentityPool', identityPool_cognitoIdentityProviders - A list representing an Amazon Cognito user pool and its client ID.

$sel:identityPoolId:IdentityPool', identityPool_identityPoolId - An identity pool ID in the format REGION:GUID.

$sel:identityPoolName:IdentityPool', identityPool_identityPoolName - A string that you provide.

$sel:allowUnauthenticatedIdentities:IdentityPool', identityPool_allowUnauthenticatedIdentities - TRUE if the identity pool supports unauthenticated logins.

An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.

Optional key:value pairs mapping provider names to provider app IDs.

Enables or disables the Basic (Classic) authentication flow. For more information, see Identity Pools (Federated Identities) Authentication Flow in the Amazon Cognito Developer Guide.

The "domain" by which Cognito will refer to your users.

The tags that are assigned to the identity pool. A tag is a label that you can apply to identity pools to categorize and manage them in different ways, such as by purpose, owner, environment, or other criteria.

The ARNs of the OpenID Connect providers.

A list representing an Amazon Cognito user pool and its client ID.

An identity pool ID in the format REGION:GUID.

A string that you provide.

TRUE if the identity pool supports unauthenticated logins.

A description of the identity pool.

See: newIdentityPoolShortDescription smart constructor.

Create a value of IdentityPoolShortDescription with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:identityPoolId:IdentityPoolShortDescription', identityPoolShortDescription_identityPoolId - An identity pool ID in the format REGION:GUID.

$sel:identityPoolName:IdentityPoolShortDescription', identityPoolShortDescription_identityPoolName - A string that you provide.

An identity pool ID in the format REGION:GUID.

A string that you provide.

A rule that maps a claim name, a claim value, and a match type to a role ARN.

See: newMappingRule smart constructor.

Create a value of MappingRule with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:claim:MappingRule', mappingRule_claim - The claim name that must be present in the token, for example, "isAdmin" or "paid".

$sel:matchType:MappingRule', mappingRule_matchType - The match condition that specifies how closely the claim value in the IdP token must match Value.

$sel:value:MappingRule', mappingRule_value - A brief string that the claim must match, for example, "paid" or "yes".

$sel:roleARN:MappingRule', mappingRule_roleARN - The role ARN.

The claim name that must be present in the token, for example, "isAdmin" or "paid".

The match condition that specifies how closely the claim value in the IdP token must match Value.

A brief string that the claim must match, for example, "paid" or "yes".

The role ARN.

A role mapping.

See: newRoleMapping smart constructor.

Create a value of RoleMapping with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:rulesConfiguration:RoleMapping', roleMapping_rulesConfiguration - The rules to be used for mapping users to roles.

If you specify Rules as the role mapping type, RulesConfiguration is required.

$sel:ambiguousRoleResolution:RoleMapping', roleMapping_ambiguousRoleResolution - If you specify Token or Rules as the Type, AmbiguousRoleResolution is required.

Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type.

$sel:type':RoleMapping', roleMapping_type - The role mapping type. Token will use cognito:roles and cognito:preferred_role claims from the Cognito identity provider token to map groups to roles. Rules will attempt to match claims from the token to map to a role.

The rules to be used for mapping users to roles.

If you specify Rules as the role mapping type, RulesConfiguration is required.

If you specify Token or Rules as the Type, AmbiguousRoleResolution is required.

Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type.

The role mapping type. Token will use cognito:roles and cognito:preferred_role claims from the Cognito identity provider token to map groups to roles. Rules will attempt to match claims from the token to map to a role.

A container for rules.

See: newRulesConfigurationType smart constructor.

Create a value of RulesConfigurationType with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:rules:RulesConfigurationType', rulesConfigurationType_rules - An array of rules. You can specify up to 25 rules per identity provider.

Rules are evaluated in order. The first one to match specifies the role.

An array of rules. You can specify up to 25 rules per identity provider.

Rules are evaluated in order. The first one to match specifies the role.

An array of UnprocessedIdentityId objects, each of which contains an ErrorCode and IdentityId.

See: newUnprocessedIdentityId smart constructor.

Create a value of UnprocessedIdentityId with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:errorCode:UnprocessedIdentityId', unprocessedIdentityId_errorCode - The error code indicating the type of error that occurred.

$sel:identityId:UnprocessedIdentityId', unprocessedIdentityId_identityId - A unique identifier in the format REGION:GUID.

The error code indicating the type of error that occurred.

A unique identifier in the format REGION:GUID.