API version 2014-06-30 of the Amazon Cognito Identity SDK configuration.

Thrown if there are parallel requests to modify a resource.

The provided developer user identifier is already registered with Cognito under a different identity ID.

An exception thrown when a dependent service such as Facebook or Twitter is not responding

Thrown when the service encounters an error during processing the request.

Thrown if the identity pool has no role associated for the given auth type (auth/unauth) or if the AssumeRole fails.

Thrown for missing or bad input parameter(s).

Thrown when the total number of user pools has exceeded a preset limit.

Thrown when a user is not authorized to access the requested resource.

Thrown when a user tries to use a login which is already linked to another account.

Thrown when the requested resource (for example, a dataset or record) does not exist.

Thrown when a request is throttled.

A provider representing an Amazon Cognito user pool and its client ID.

See: newCognitoIdentityProvider smart constructor.

Create a value of CognitoIdentityProvider with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:clientId:CognitoIdentityProvider', cognitoIdentityProvider_clientId - The client ID for the Amazon Cognito user pool.

$sel:providerName:CognitoIdentityProvider', cognitoIdentityProvider_providerName - The provider name for an Amazon Cognito user pool. For example, cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789.

$sel:serverSideTokenCheck:CognitoIdentityProvider', cognitoIdentityProvider_serverSideTokenCheck - TRUE if server-side token validation is enabled for the identity provider’s token.

Once you set ServerSideTokenCheck to TRUE for an identity pool, that identity pool will check with the integrated user pools to make sure that the user has not been globally signed out or deleted before the identity pool provides an OIDC token or AWS credentials for the user.

If the user is signed out or deleted, the identity pool will return a 400 Not Authorized error.

The client ID for the Amazon Cognito user pool.

The provider name for an Amazon Cognito user pool. For example, cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789.

TRUE if server-side token validation is enabled for the identity provider’s token.

Once you set ServerSideTokenCheck to TRUE for an identity pool, that identity pool will check with the integrated user pools to make sure that the user has not been globally signed out or deleted before the identity pool provides an OIDC token or AWS credentials for the user.

If the user is signed out or deleted, the identity pool will return a 400 Not Authorized error.

Credentials for the provided identity ID.

See: newCredentials smart constructor.

Create a value of Credentials with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:accessKeyId:Credentials', credentials_accessKeyId - The Access Key portion of the credentials.

$sel:expiration:Credentials', credentials_expiration - The date at which these credentials will expire.

$sel:secretKey:Credentials', credentials_secretKey - The Secret Access Key portion of the credentials

$sel:sessionToken:Credentials', credentials_sessionToken - The Session Token portion of the credentials

The Access Key portion of the credentials.

The date at which these credentials will expire.

The Secret Access Key portion of the credentials

The Session Token portion of the credentials

A description of the identity.

See: newIdentityDescription smart constructor.

Create a value of IdentityDescription with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:creationDate:IdentityDescription', identityDescription_creationDate - Date on which the identity was created.

$sel:identityId:IdentityDescription', identityDescription_identityId - A unique identifier in the format REGION:GUID.

$sel:lastModifiedDate:IdentityDescription', identityDescription_lastModifiedDate - Date on which the identity was last modified.

$sel:logins:IdentityDescription', identityDescription_logins - The provider names.

Date on which the identity was created.

A unique identifier in the format REGION:GUID.

Date on which the identity was last modified.

The provider names.

An object representing an Amazon Cognito identity pool.

See: newIdentityPool smart constructor.

Create a value of IdentityPool with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:allowClassicFlow:IdentityPool', identityPool_allowClassicFlow - Enables or disables the Basic (Classic) authentication flow. For more information, see Identity Pools (Federated Identities) Authentication Flow in the Amazon Cognito Developer Guide.

$sel:cognitoIdentityProviders:IdentityPool', identityPool_cognitoIdentityProviders - A list representing an Amazon Cognito user pool and its client ID.

$sel:developerProviderName:IdentityPool', identityPool_developerProviderName - The "domain" by which Cognito will refer to your users.

$sel:identityPoolTags:IdentityPool', identityPool_identityPoolTags - The tags that are assigned to the identity pool. A tag is a label that you can apply to identity pools to categorize and manage them in different ways, such as by purpose, owner, environment, or other criteria.

$sel:openIdConnectProviderARNs:IdentityPool', identityPool_openIdConnectProviderARNs - The ARNs of the OpenID Connect providers.

$sel:samlProviderARNs:IdentityPool', identityPool_samlProviderARNs - An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.

$sel:supportedLoginProviders:IdentityPool', identityPool_supportedLoginProviders - Optional key:value pairs mapping provider names to provider app IDs.

$sel:identityPoolId:IdentityPool', identityPool_identityPoolId - An identity pool ID in the format REGION:GUID.

$sel:identityPoolName:IdentityPool', identityPool_identityPoolName - A string that you provide.

$sel:allowUnauthenticatedIdentities:IdentityPool', identityPool_allowUnauthenticatedIdentities - TRUE if the identity pool supports unauthenticated logins.

Enables or disables the Basic (Classic) authentication flow. For more information, see Identity Pools (Federated Identities) Authentication Flow in the Amazon Cognito Developer Guide.

A list representing an Amazon Cognito user pool and its client ID.

The "domain" by which Cognito will refer to your users.

The tags that are assigned to the identity pool. A tag is a label that you can apply to identity pools to categorize and manage them in different ways, such as by purpose, owner, environment, or other criteria.

The ARNs of the OpenID Connect providers.

An array of Amazon Resource Names (ARNs) of the SAML provider for your identity pool.

Optional key:value pairs mapping provider names to provider app IDs.

An identity pool ID in the format REGION:GUID.

A string that you provide.

TRUE if the identity pool supports unauthenticated logins.

A description of the identity pool.

See: newIdentityPoolShortDescription smart constructor.

Create a value of IdentityPoolShortDescription with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:identityPoolId:IdentityPoolShortDescription', identityPoolShortDescription_identityPoolId - An identity pool ID in the format REGION:GUID.

$sel:identityPoolName:IdentityPoolShortDescription', identityPoolShortDescription_identityPoolName - A string that you provide.

An identity pool ID in the format REGION:GUID.

A string that you provide.

A rule that maps a claim name, a claim value, and a match type to a role ARN.

See: newMappingRule smart constructor.

Create a value of MappingRule with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:claim:MappingRule', mappingRule_claim - The claim name that must be present in the token, for example, "isAdmin" or "paid".

$sel:matchType:MappingRule', mappingRule_matchType - The match condition that specifies how closely the claim value in the IdP token must match Value.

$sel:value:MappingRule', mappingRule_value - A brief string that the claim must match, for example, "paid" or "yes".

$sel:roleARN:MappingRule', mappingRule_roleARN - The role ARN.

The claim name that must be present in the token, for example, "isAdmin" or "paid".

The match condition that specifies how closely the claim value in the IdP token must match Value.

A brief string that the claim must match, for example, "paid" or "yes".

The role ARN.

A role mapping.

See: newRoleMapping smart constructor.

Create a value of RoleMapping with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:ambiguousRoleResolution:RoleMapping', roleMapping_ambiguousRoleResolution - If you specify Token or Rules as the Type, AmbiguousRoleResolution is required.

Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type.

$sel:rulesConfiguration:RoleMapping', roleMapping_rulesConfiguration - The rules to be used for mapping users to roles.

If you specify Rules as the role mapping type, RulesConfiguration is required.

$sel:type':RoleMapping', roleMapping_type - The role mapping type. Token will use cognito:roles and cognito:preferred_role claims from the Cognito identity provider token to map groups to roles. Rules will attempt to match claims from the token to map to a role.

If you specify Token or Rules as the Type, AmbiguousRoleResolution is required.

Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type.

The rules to be used for mapping users to roles.

If you specify Rules as the role mapping type, RulesConfiguration is required.

The role mapping type. Token will use cognito:roles and cognito:preferred_role claims from the Cognito identity provider token to map groups to roles. Rules will attempt to match claims from the token to map to a role.

A container for rules.

See: newRulesConfigurationType smart constructor.

Create a value of RulesConfigurationType with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:rules:RulesConfigurationType', rulesConfigurationType_rules - An array of rules. You can specify up to 25 rules per identity provider.

Rules are evaluated in order. The first one to match specifies the role.

An array of rules. You can specify up to 25 rules per identity provider.

Rules are evaluated in order. The first one to match specifies the role.

An array of UnprocessedIdentityId objects, each of which contains an ErrorCode and IdentityId.

See: newUnprocessedIdentityId smart constructor.

Create a value of UnprocessedIdentityId with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:errorCode:UnprocessedIdentityId', unprocessedIdentityId_errorCode - The error code indicating the type of error that occurred.

$sel:identityId:UnprocessedIdentityId', unprocessedIdentityId_identityId - A unique identifier in the format REGION:GUID.

The error code indicating the type of error that occurred.

A unique identifier in the format REGION:GUID.