1. Packages
  2. AWS
  3. API Docs
  4. cognito
  5. IdentityPoolProviderPrincipalTag
AWS v7.11.0 published on Wednesday, Nov 5, 2025 by Pulumi
pulumi/pulumi-aws

aws.cognito.IdentityPoolProviderPrincipalTag

Get Started
aws logo
AWS v7.11.0 published on Wednesday, Nov 5, 2025 by Pulumi
pulumi/pulumi-aws

    Provides an AWS Cognito Identity Principal Mapping.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as std from "@pulumi/std";

const example = new aws.cognito.UserPool("example", {
    name: "user pool",
    autoVerifiedAttributes: ["email"],
});
const exampleUserPoolClient = new aws.cognito.UserPoolClient("example", {
    name: "client",
    userPoolId: example.id,
    supportedIdentityProviders: std.compact({
        input: ["COGNITO"],
    }).then(invoke => invoke.result),
});
const exampleIdentityPool = new aws.cognito.IdentityPool("example", {
    identityPoolName: "identity pool",
    allowUnauthenticatedIdentities: false,
    cognitoIdentityProviders: [{
        clientId: exampleUserPoolClient.id,
        providerName: example.endpoint,
        serverSideTokenCheck: false,
    }],
});
const exampleIdentityPoolProviderPrincipalTag = new aws.cognito.IdentityPoolProviderPrincipalTag("example", {
    identityPoolId: exampleIdentityPool.id,
    identityProviderName: example.endpoint,
    useDefaults: false,
    principalTags: {
        test: "value",
    },
});

    import pulumi
import pulumi_aws as aws
import pulumi_std as std

example = aws.cognito.UserPool("example",
    name="user pool",
    auto_verified_attributes=["email"])
example_user_pool_client = aws.cognito.UserPoolClient("example",
    name="client",
    user_pool_id=example.id,
    supported_identity_providers=std.compact(input=["COGNITO"]).result)
example_identity_pool = aws.cognito.IdentityPool("example",
    identity_pool_name="identity pool",
    allow_unauthenticated_identities=False,
    cognito_identity_providers=[{
        "client_id": example_user_pool_client.id,
        "provider_name": example.endpoint,
        "server_side_token_check": False,
    }])
example_identity_pool_provider_principal_tag = aws.cognito.IdentityPoolProviderPrincipalTag("example",
    identity_pool_id=example_identity_pool.id,
    identity_provider_name=example.endpoint,
    use_defaults=False,
    principal_tags={
        "test": "value",
    })

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cognito"
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := cognito.NewUserPool(ctx, "example", &cognito.UserPoolArgs{
			Name: pulumi.String("user pool"),
			AutoVerifiedAttributes: pulumi.StringArray{
				pulumi.String("email"),
			},
		})
		if err != nil {
			return err
		}
		invokeCompact, err := std.Compact(ctx, &std.CompactArgs{
			Input: []string{
				"COGNITO",
			},
		}, nil)
		if err != nil {
			return err
		}
		exampleUserPoolClient, err := cognito.NewUserPoolClient(ctx, "example", &cognito.UserPoolClientArgs{
			Name:                       pulumi.String("client"),
			UserPoolId:                 example.ID(),
			SupportedIdentityProviders: pulumi.StringArray(invokeCompact.Result),
		})
		if err != nil {
			return err
		}
		exampleIdentityPool, err := cognito.NewIdentityPool(ctx, "example", &cognito.IdentityPoolArgs{
			IdentityPoolName:               pulumi.String("identity pool"),
			AllowUnauthenticatedIdentities: pulumi.Bool(false),
			CognitoIdentityProviders: cognito.IdentityPoolCognitoIdentityProviderArray{
				&cognito.IdentityPoolCognitoIdentityProviderArgs{
					ClientId:             exampleUserPoolClient.ID(),
					ProviderName:         example.Endpoint,
					ServerSideTokenCheck: pulumi.Bool(false),
				},
			},
		})
		if err != nil {
			return err
		}
		_, err = cognito.NewIdentityPoolProviderPrincipalTag(ctx, "example", &cognito.IdentityPoolProviderPrincipalTagArgs{
			IdentityPoolId:       exampleIdentityPool.ID(),
			IdentityProviderName: example.Endpoint,
			UseDefaults:          pulumi.Bool(false),
			PrincipalTags: pulumi.StringMap{
				"test": pulumi.String("value"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
using Std = Pulumi.Std;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Cognito.UserPool("example", new()
    {
        Name = "user pool",
        AutoVerifiedAttributes = new[]
        {
            "email",
        },
    });

    var exampleUserPoolClient = new Aws.Cognito.UserPoolClient("example", new()
    {
        Name = "client",
        UserPoolId = example.Id,
        SupportedIdentityProviders = Std.Compact.Invoke(new()
        {
            Input = new[]
            {
                "COGNITO",
            },
        }).Apply(invoke => invoke.Result),
    });

    var exampleIdentityPool = new Aws.Cognito.IdentityPool("example", new()
    {
        IdentityPoolName = "identity pool",
        AllowUnauthenticatedIdentities = false,
        CognitoIdentityProviders = new[]
        {
            new Aws.Cognito.Inputs.IdentityPoolCognitoIdentityProviderArgs
            {
                ClientId = exampleUserPoolClient.Id,
                ProviderName = example.Endpoint,
                ServerSideTokenCheck = false,
            },
        },
    });

    var exampleIdentityPoolProviderPrincipalTag = new Aws.Cognito.IdentityPoolProviderPrincipalTag("example", new()
    {
        IdentityPoolId = exampleIdentityPool.Id,
        IdentityProviderName = example.Endpoint,
        UseDefaults = false,
        PrincipalTags = 
        {
            { "test", "value" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cognito.UserPool;
import com.pulumi.aws.cognito.UserPoolArgs;
import com.pulumi.aws.cognito.UserPoolClient;
import com.pulumi.aws.cognito.UserPoolClientArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.CompactArgs;
import com.pulumi.aws.cognito.IdentityPool;
import com.pulumi.aws.cognito.IdentityPoolArgs;
import com.pulumi.aws.cognito.inputs.IdentityPoolCognitoIdentityProviderArgs;
import com.pulumi.aws.cognito.IdentityPoolProviderPrincipalTag;
import com.pulumi.aws.cognito.IdentityPoolProviderPrincipalTagArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new UserPool("example", UserPoolArgs.builder()
            .name("user pool")
            .autoVerifiedAttributes("email")
            .build());

        var exampleUserPoolClient = new UserPoolClient("exampleUserPoolClient", UserPoolClientArgs.builder()
            .name("client")
            .userPoolId(example.id())
            .supportedIdentityProviders(StdFunctions.compact(CompactArgs.builder()
                .input("COGNITO")
                .build()).result())
            .build());

        var exampleIdentityPool = new IdentityPool("exampleIdentityPool", IdentityPoolArgs.builder()
            .identityPoolName("identity pool")
            .allowUnauthenticatedIdentities(false)
            .cognitoIdentityProviders(IdentityPoolCognitoIdentityProviderArgs.builder()
                .clientId(exampleUserPoolClient.id())
                .providerName(example.endpoint())
                .serverSideTokenCheck(false)
                .build())
            .build());

        var exampleIdentityPoolProviderPrincipalTag = new IdentityPoolProviderPrincipalTag("exampleIdentityPoolProviderPrincipalTag", IdentityPoolProviderPrincipalTagArgs.builder()
            .identityPoolId(exampleIdentityPool.id())
            .identityProviderName(example.endpoint())
            .useDefaults(false)
            .principalTags(Map.of("test", "value"))
            .build());

    }
}

    resources:
  example:
    type: aws:cognito:UserPool
    properties:
      name: user pool
      autoVerifiedAttributes:
        - email
  exampleUserPoolClient:
    type: aws:cognito:UserPoolClient
    name: example
    properties:
      name: client
      userPoolId: ${example.id}
      supportedIdentityProviders:
        fn::invoke:
          function: std:compact
          arguments:
            input:
              - COGNITO
          return: result
  exampleIdentityPool:
    type: aws:cognito:IdentityPool
    name: example
    properties:
      identityPoolName: identity pool
      allowUnauthenticatedIdentities: false
      cognitoIdentityProviders:
        - clientId: ${exampleUserPoolClient.id}
          providerName: ${example.endpoint}
          serverSideTokenCheck: false
  exampleIdentityPoolProviderPrincipalTag:
    type: aws:cognito:IdentityPoolProviderPrincipalTag
    name: example
    properties:
      identityPoolId: ${exampleIdentityPool.id}
      identityProviderName: ${example.endpoint}
      useDefaults: false
      principalTags:
        test: value

    Create IdentityPoolProviderPrincipalTag Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new IdentityPoolProviderPrincipalTag(name: string, args: IdentityPoolProviderPrincipalTagArgs, opts?: CustomResourceOptions);
    @overload
def IdentityPoolProviderPrincipalTag(resource_name: str,
                                     args: IdentityPoolProviderPrincipalTagArgs,
                                     opts: Optional[ResourceOptions] = None)

@overload
def IdentityPoolProviderPrincipalTag(resource_name: str,
                                     opts: Optional[ResourceOptions] = None,
                                     identity_pool_id: Optional[str] = None,
                                     identity_provider_name: Optional[str] = None,
                                     principal_tags: Optional[Mapping[str, str]] = None,
                                     region: Optional[str] = None,
                                     use_defaults: Optional[bool] = None)
    func NewIdentityPoolProviderPrincipalTag(ctx *Context, name string, args IdentityPoolProviderPrincipalTagArgs, opts ...ResourceOption) (*IdentityPoolProviderPrincipalTag, error)
    public IdentityPoolProviderPrincipalTag(string name, IdentityPoolProviderPrincipalTagArgs args, CustomResourceOptions? opts = null)
    public IdentityPoolProviderPrincipalTag(String name, IdentityPoolProviderPrincipalTagArgs args)
public IdentityPoolProviderPrincipalTag(String name, IdentityPoolProviderPrincipalTagArgs args, CustomResourceOptions options)

    type: aws:cognito:IdentityPoolProviderPrincipalTag
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args IdentityPoolProviderPrincipalTagArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args IdentityPoolProviderPrincipalTagArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args IdentityPoolProviderPrincipalTagArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args IdentityPoolProviderPrincipalTagArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args IdentityPoolProviderPrincipalTagArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var identityPoolProviderPrincipalTagResource = new Aws.Cognito.IdentityPoolProviderPrincipalTag("identityPoolProviderPrincipalTagResource", new()
{
    IdentityPoolId = "string",
    IdentityProviderName = "string",
    PrincipalTags = 
    {
        { "string", "string" },
    },
    Region = "string",
    UseDefaults = false,
});

    example, err := cognito.NewIdentityPoolProviderPrincipalTag(ctx, "identityPoolProviderPrincipalTagResource", &cognito.IdentityPoolProviderPrincipalTagArgs{
	IdentityPoolId:       pulumi.String("string"),
	IdentityProviderName: pulumi.String("string"),
	PrincipalTags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Region:      pulumi.String("string"),
	UseDefaults: pulumi.Bool(false),
})

    var identityPoolProviderPrincipalTagResource = new IdentityPoolProviderPrincipalTag("identityPoolProviderPrincipalTagResource", IdentityPoolProviderPrincipalTagArgs.builder()
    .identityPoolId("string")
    .identityProviderName("string")
    .principalTags(Map.of("string", "string"))
    .region("string")
    .useDefaults(false)
    .build());

    identity_pool_provider_principal_tag_resource = aws.cognito.IdentityPoolProviderPrincipalTag("identityPoolProviderPrincipalTagResource",
    identity_pool_id="string",
    identity_provider_name="string",
    principal_tags={
        "string": "string",
    },
    region="string",
    use_defaults=False)

    const identityPoolProviderPrincipalTagResource = new aws.cognito.IdentityPoolProviderPrincipalTag("identityPoolProviderPrincipalTagResource", {
    identityPoolId: "string",
    identityProviderName: "string",
    principalTags: {
        string: "string",
    },
    region: "string",
    useDefaults: false,
});

    type: aws:cognito:IdentityPoolProviderPrincipalTag
properties:
    identityPoolId: string
    identityProviderName: string
    principalTags:
        string: string
    region: string
    useDefaults: false

    IdentityPoolProviderPrincipalTag Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The IdentityPoolProviderPrincipalTag resource accepts the following input properties:

    IdentityPoolId string
    An identity pool ID.
    IdentityProviderName string
    The name of the identity provider.
    PrincipalTags Dictionary<string, string>
    String to string map of variables.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    UseDefaults bool
    use default (username and clientID) attribute mappings.
    IdentityPoolId string
    An identity pool ID.
    IdentityProviderName string
    The name of the identity provider.
    PrincipalTags map[string]string
    String to string map of variables.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    UseDefaults bool
    use default (username and clientID) attribute mappings.
    identityPoolId String
    An identity pool ID.
    identityProviderName String
    The name of the identity provider.
    principalTags Map<String,String>
    String to string map of variables.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    useDefaults Boolean
    use default (username and clientID) attribute mappings.
    identityPoolId string
    An identity pool ID.
    identityProviderName string
    The name of the identity provider.
    principalTags {[key: string]: string}
    String to string map of variables.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    useDefaults boolean
    use default (username and clientID) attribute mappings.
    identity_pool_id str
    An identity pool ID.
    identity_provider_name str
    The name of the identity provider.
    principal_tags Mapping[str, str]
    String to string map of variables.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    use_defaults bool
    use default (username and clientID) attribute mappings.
    identityPoolId String
    An identity pool ID.
    identityProviderName String
    The name of the identity provider.
    principalTags Map<String>
    String to string map of variables.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    useDefaults Boolean
    use default (username and clientID) attribute mappings.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the IdentityPoolProviderPrincipalTag resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing IdentityPoolProviderPrincipalTag Resource

    Get an existing IdentityPoolProviderPrincipalTag resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: IdentityPoolProviderPrincipalTagState, opts?: CustomResourceOptions): IdentityPoolProviderPrincipalTag
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        identity_pool_id: Optional[str] = None,
        identity_provider_name: Optional[str] = None,
        principal_tags: Optional[Mapping[str, str]] = None,
        region: Optional[str] = None,
        use_defaults: Optional[bool] = None) -> IdentityPoolProviderPrincipalTag
    func GetIdentityPoolProviderPrincipalTag(ctx *Context, name string, id IDInput, state *IdentityPoolProviderPrincipalTagState, opts ...ResourceOption) (*IdentityPoolProviderPrincipalTag, error)
    public static IdentityPoolProviderPrincipalTag Get(string name, Input<string> id, IdentityPoolProviderPrincipalTagState? state, CustomResourceOptions? opts = null)
    public static IdentityPoolProviderPrincipalTag get(String name, Output<String> id, IdentityPoolProviderPrincipalTagState state, CustomResourceOptions options)
    resources:  _:    type: aws:cognito:IdentityPoolProviderPrincipalTag    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    IdentityPoolId string
    An identity pool ID.
    IdentityProviderName string
    The name of the identity provider.
    PrincipalTags Dictionary<string, string>
    String to string map of variables.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    UseDefaults bool
    use default (username and clientID) attribute mappings.
    IdentityPoolId string
    An identity pool ID.
    IdentityProviderName string
    The name of the identity provider.
    PrincipalTags map[string]string
    String to string map of variables.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    UseDefaults bool
    use default (username and clientID) attribute mappings.
    identityPoolId String
    An identity pool ID.
    identityProviderName String
    The name of the identity provider.
    principalTags Map<String,String>
    String to string map of variables.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    useDefaults Boolean
    use default (username and clientID) attribute mappings.
    identityPoolId string
    An identity pool ID.
    identityProviderName string
    The name of the identity provider.
    principalTags {[key: string]: string}
    String to string map of variables.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    useDefaults boolean
    use default (username and clientID) attribute mappings.
    identity_pool_id str
    An identity pool ID.
    identity_provider_name str
    The name of the identity provider.
    principal_tags Mapping[str, str]
    String to string map of variables.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    use_defaults bool
    use default (username and clientID) attribute mappings.
    identityPoolId String
    An identity pool ID.
    identityProviderName String
    The name of the identity provider.
    principalTags Map<String>
    String to string map of variables.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    useDefaults Boolean
    use default (username and clientID) attribute mappings.

    Import

    Using pulumi import, import Cognito Identity Pool Roles Attachment using the Identity Pool ID and provider name. For example:

    $ pulumi import aws:cognito/identityPoolProviderPrincipalTag:IdentityPoolProviderPrincipalTag example us-west-2_abc123:CorpAD

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo
    AWS v7.11.0 published on Wednesday, Nov 5, 2025 by Pulumi
    pulumi/pulumi-aws
      Meet Neo: Your AI Platform Teammate