Docs Packages
  1. Packages
  2. AWS Classic
  3. API Docs
  4. cognito
  5. ManagedUserPoolClient

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.13.1 published on Tuesday, Dec 5, 2023 by Pulumi
pulumi/pulumi-aws

aws.cognito.ManagedUserPoolClient

Explore with Pulumi AI

aws logo

Try AWS Native preview for resources not in the classic version.

AWS Classic v6.13.1 published on Tuesday, Dec 5, 2023 by Pulumi
pulumi/pulumi-aws

    Use the aws.cognito.UserPoolClient resource to manage a Cognito User Pool Client.

    This resource is advanced and has special caveats to consider before use. Please read this document completely before using the resource.

    Use the aws.cognito.ManagedUserPoolClient resource to manage a Cognito User Pool Client that is automatically created by an AWS service. For instance, when configuring an OpenSearch Domain to use Cognito authentication, the OpenSearch service creates the User Pool Client during setup and removes it when it is no longer required. As a result, the aws.cognito.ManagedUserPoolClient resource does not create or delete this resource, but instead assumes management of it.

    Use the aws.cognito.UserPoolClient resource to manage Cognito User Pool Clients for normal use cases.

    Example Usage

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var exampleUserPool = new Aws.Cognito.UserPool("exampleUserPool");

    var exampleIdentityPool = new Aws.Cognito.IdentityPool("exampleIdentityPool", new()
    {
        IdentityPoolName = "example",
    });

    var current = Aws.GetPartition.Invoke();

    var examplePolicyDocument = Aws.Iam.GetPolicyDocument.Invoke(new()
    {
        Statements = new[]
        {
            new Aws.Iam.Inputs.GetPolicyDocumentStatementInputArgs
            {
                Sid = "",
                Actions = new[]
                {
                    "sts:AssumeRole",
                },
                Effect = "Allow",
                Principals = new[]
                {
                    new Aws.Iam.Inputs.GetPolicyDocumentStatementPrincipalInputArgs
                    {
                        Type = "Service",
                        Identifiers = new[]
                        {
                            $"es.{current.Apply(getPartitionResult => getPartitionResult.DnsSuffix)}",
                        },
                    },
                },
            },
        },
    });

    var exampleRole = new Aws.Iam.Role("exampleRole", new()
    {
        Path = "/service-role/",
        AssumeRolePolicy = examplePolicyDocument.Apply(getPolicyDocumentResult => getPolicyDocumentResult.Json),
    });

    var exampleRolePolicyAttachment = new Aws.Iam.RolePolicyAttachment("exampleRolePolicyAttachment", new()
    {
        Role = exampleRole.Name,
        PolicyArn = $"arn:{current.Apply(getPartitionResult => getPartitionResult.Partition)}:iam::aws:policy/AmazonESCognitoAccess",
    });

    var exampleDomain = new Aws.OpenSearch.Domain("exampleDomain", new()
    {
        CognitoOptions = new Aws.OpenSearch.Inputs.DomainCognitoOptionsArgs
        {
            Enabled = true,
            UserPoolId = exampleUserPool.Id,
            IdentityPoolId = exampleIdentityPool.Id,
            RoleArn = exampleRole.Arn,
        },
        EbsOptions = new Aws.OpenSearch.Inputs.DomainEbsOptionsArgs
        {
            EbsEnabled = true,
            VolumeSize = 10,
        },
    }, new CustomResourceOptions
    {
        DependsOn = new[]
        {
            aws_cognito_user_pool_domain.Example,
            exampleRolePolicyAttachment,
        },
    });

    var exampleManagedUserPoolClient = new Aws.Cognito.ManagedUserPoolClient("exampleManagedUserPoolClient", new()
    {
        NamePrefix = "AmazonOpenSearchService-example",
        UserPoolId = exampleUserPool.Id,
    }, new CustomResourceOptions
    {
        DependsOn = new[]
        {
            exampleDomain,
        },
    });

});

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/cognito"
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/iam"
	"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/opensearch"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		exampleUserPool, err := cognito.NewUserPool(ctx, "exampleUserPool", nil)
		if err != nil {
			return err
		}
		exampleIdentityPool, err := cognito.NewIdentityPool(ctx, "exampleIdentityPool", &cognito.IdentityPoolArgs{
			IdentityPoolName: pulumi.String("example"),
		})
		if err != nil {
			return err
		}
		current, err := aws.GetPartition(ctx, nil, nil)
		if err != nil {
			return err
		}
		examplePolicyDocument, err := iam.GetPolicyDocument(ctx, &iam.GetPolicyDocumentArgs{
			Statements: []iam.GetPolicyDocumentStatement{
				{
					Sid: pulumi.StringRef(""),
					Actions: []string{
						"sts:AssumeRole",
					},
					Effect: pulumi.StringRef("Allow"),
					Principals: []iam.GetPolicyDocumentStatementPrincipal{
						{
							Type: "Service",
							Identifiers: []string{
								fmt.Sprintf("es.%v", current.DnsSuffix),
							},
						},
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		exampleRole, err := iam.NewRole(ctx, "exampleRole", &iam.RoleArgs{
			Path:             pulumi.String("/service-role/"),
			AssumeRolePolicy: *pulumi.String(examplePolicyDocument.Json),
		})
		if err != nil {
			return err
		}
		exampleRolePolicyAttachment, err := iam.NewRolePolicyAttachment(ctx, "exampleRolePolicyAttachment", &iam.RolePolicyAttachmentArgs{
			Role:      exampleRole.Name,
			PolicyArn: pulumi.String(fmt.Sprintf("arn:%v:iam::aws:policy/AmazonESCognitoAccess", current.Partition)),
		})
		if err != nil {
			return err
		}
		exampleDomain, err := opensearch.NewDomain(ctx, "exampleDomain", &opensearch.DomainArgs{
			CognitoOptions: &opensearch.DomainCognitoOptionsArgs{
				Enabled:        pulumi.Bool(true),
				UserPoolId:     exampleUserPool.ID(),
				IdentityPoolId: exampleIdentityPool.ID(),
				RoleArn:        exampleRole.Arn,
			},
			EbsOptions: &opensearch.DomainEbsOptionsArgs{
				EbsEnabled: pulumi.Bool(true),
				VolumeSize: pulumi.Int(10),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			aws_cognito_user_pool_domain.Example,
			exampleRolePolicyAttachment,
		}))
		if err != nil {
			return err
		}
		_, err = cognito.NewManagedUserPoolClient(ctx, "exampleManagedUserPoolClient", &cognito.ManagedUserPoolClientArgs{
			NamePrefix: pulumi.String("AmazonOpenSearchService-example"),
			UserPoolId: exampleUserPool.ID(),
		}, pulumi.DependsOn([]pulumi.Resource{
			exampleDomain,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cognito.UserPool;
import com.pulumi.aws.cognito.IdentityPool;
import com.pulumi.aws.cognito.IdentityPoolArgs;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetPartitionArgs;
import com.pulumi.aws.iam.IamFunctions;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.iam.RolePolicyAttachment;
import com.pulumi.aws.iam.RolePolicyAttachmentArgs;
import com.pulumi.aws.opensearch.Domain;
import com.pulumi.aws.opensearch.DomainArgs;
import com.pulumi.aws.opensearch.inputs.DomainCognitoOptionsArgs;
import com.pulumi.aws.opensearch.inputs.DomainEbsOptionsArgs;
import com.pulumi.aws.cognito.ManagedUserPoolClient;
import com.pulumi.aws.cognito.ManagedUserPoolClientArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleUserPool = new UserPool("exampleUserPool");

        var exampleIdentityPool = new IdentityPool("exampleIdentityPool", IdentityPoolArgs.builder()        
            .identityPoolName("example")
            .build());

        final var current = AwsFunctions.getPartition();

        final var examplePolicyDocument = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .sid("")
                .actions("sts:AssumeRole")
                .effect("Allow")
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .type("Service")
                    .identifiers(String.format("es.%s", current.applyValue(getPartitionResult -> getPartitionResult.dnsSuffix())))
                    .build())
                .build())
            .build());

        var exampleRole = new Role("exampleRole", RoleArgs.builder()        
            .path("/service-role/")
            .assumeRolePolicy(examplePolicyDocument.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json()))
            .build());

        var exampleRolePolicyAttachment = new RolePolicyAttachment("exampleRolePolicyAttachment", RolePolicyAttachmentArgs.builder()        
            .role(exampleRole.name())
            .policyArn(String.format("arn:%s:iam::aws:policy/AmazonESCognitoAccess", current.applyValue(getPartitionResult -> getPartitionResult.partition())))
            .build());

        var exampleDomain = new Domain("exampleDomain", DomainArgs.builder()        
            .cognitoOptions(DomainCognitoOptionsArgs.builder()
                .enabled(true)
                .userPoolId(exampleUserPool.id())
                .identityPoolId(exampleIdentityPool.id())
                .roleArn(exampleRole.arn())
                .build())
            .ebsOptions(DomainEbsOptionsArgs.builder()
                .ebsEnabled(true)
                .volumeSize(10)
                .build())
            .build(), CustomResourceOptions.builder()
                .dependsOn(                
                    aws_cognito_user_pool_domain.example(),
                    exampleRolePolicyAttachment)
                .build());

        var exampleManagedUserPoolClient = new ManagedUserPoolClient("exampleManagedUserPoolClient", ManagedUserPoolClientArgs.builder()        
            .namePrefix("AmazonOpenSearchService-example")
            .userPoolId(exampleUserPool.id())
            .build(), CustomResourceOptions.builder()
                .dependsOn(exampleDomain)
                .build());

    }
}

    import pulumi
import pulumi_aws as aws

example_user_pool = aws.cognito.UserPool("exampleUserPool")
example_identity_pool = aws.cognito.IdentityPool("exampleIdentityPool", identity_pool_name="example")
current = aws.get_partition()
example_policy_document = aws.iam.get_policy_document(statements=[aws.iam.GetPolicyDocumentStatementArgs(
    sid="",
    actions=["sts:AssumeRole"],
    effect="Allow",
    principals=[aws.iam.GetPolicyDocumentStatementPrincipalArgs(
        type="Service",
        identifiers=[f"es.{current.dns_suffix}"],
    )],
)])
example_role = aws.iam.Role("exampleRole",
    path="/service-role/",
    assume_role_policy=example_policy_document.json)
example_role_policy_attachment = aws.iam.RolePolicyAttachment("exampleRolePolicyAttachment",
    role=example_role.name,
    policy_arn=f"arn:{current.partition}:iam::aws:policy/AmazonESCognitoAccess")
example_domain = aws.opensearch.Domain("exampleDomain",
    cognito_options=aws.opensearch.DomainCognitoOptionsArgs(
        enabled=True,
        user_pool_id=example_user_pool.id,
        identity_pool_id=example_identity_pool.id,
        role_arn=example_role.arn,
    ),
    ebs_options=aws.opensearch.DomainEbsOptionsArgs(
        ebs_enabled=True,
        volume_size=10,
    ),
    opts=pulumi.ResourceOptions(depends_on=[
            aws_cognito_user_pool_domain["example"],
            example_role_policy_attachment,
        ]))
example_managed_user_pool_client = aws.cognito.ManagedUserPoolClient("exampleManagedUserPoolClient",
    name_prefix="AmazonOpenSearchService-example",
    user_pool_id=example_user_pool.id,
    opts=pulumi.ResourceOptions(depends_on=[example_domain]))

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const exampleUserPool = new aws.cognito.UserPool("exampleUserPool", {});
const exampleIdentityPool = new aws.cognito.IdentityPool("exampleIdentityPool", {identityPoolName: "example"});
const current = aws.getPartition({});
const examplePolicyDocument = current.then(current => aws.iam.getPolicyDocument({
    statements: [{
        sid: "",
        actions: ["sts:AssumeRole"],
        effect: "Allow",
        principals: [{
            type: "Service",
            identifiers: [`es.${current.dnsSuffix}`],
        }],
    }],
}));
const exampleRole = new aws.iam.Role("exampleRole", {
    path: "/service-role/",
    assumeRolePolicy: examplePolicyDocument.then(examplePolicyDocument => examplePolicyDocument.json),
});
const exampleRolePolicyAttachment = new aws.iam.RolePolicyAttachment("exampleRolePolicyAttachment", {
    role: exampleRole.name,
    policyArn: current.then(current => `arn:${current.partition}:iam::aws:policy/AmazonESCognitoAccess`),
});
const exampleDomain = new aws.opensearch.Domain("exampleDomain", {
    cognitoOptions: {
        enabled: true,
        userPoolId: exampleUserPool.id,
        identityPoolId: exampleIdentityPool.id,
        roleArn: exampleRole.arn,
    },
    ebsOptions: {
        ebsEnabled: true,
        volumeSize: 10,
    },
}, {
    dependsOn: [
        aws_cognito_user_pool_domain.example,
        exampleRolePolicyAttachment,
    ],
});
const exampleManagedUserPoolClient = new aws.cognito.ManagedUserPoolClient("exampleManagedUserPoolClient", {
    namePrefix: "AmazonOpenSearchService-example",
    userPoolId: exampleUserPool.id,
}, {
    dependsOn: [exampleDomain],
});

    resources:
  exampleManagedUserPoolClient:
    type: aws:cognito:ManagedUserPoolClient
    properties:
      namePrefix: AmazonOpenSearchService-example
      userPoolId: ${exampleUserPool.id}
    options:
      dependson:
        - ${exampleDomain}
  exampleUserPool:
    type: aws:cognito:UserPool
  exampleIdentityPool:
    type: aws:cognito:IdentityPool
    properties:
      identityPoolName: example
  exampleDomain:
    type: aws:opensearch:Domain
    properties:
      cognitoOptions:
        enabled: true
        userPoolId: ${exampleUserPool.id}
        identityPoolId: ${exampleIdentityPool.id}
        roleArn: ${exampleRole.arn}
      ebsOptions:
        ebsEnabled: true
        volumeSize: 10
    options:
      dependson:
        - ${aws_cognito_user_pool_domain.example}
        - ${exampleRolePolicyAttachment}
  exampleRole:
    type: aws:iam:Role
    properties:
      path: /service-role/
      assumeRolePolicy: ${examplePolicyDocument.json}
  exampleRolePolicyAttachment:
    type: aws:iam:RolePolicyAttachment
    properties:
      role: ${exampleRole.name}
      policyArn: arn:${current.partition}:iam::aws:policy/AmazonESCognitoAccess
variables:
  examplePolicyDocument:
    fn::invoke:
      Function: aws:iam:getPolicyDocument
      Arguments:
        statements:
          - sid:
            actions:
              - sts:AssumeRole
            effect: Allow
            principals:
              - type: Service
                identifiers:
                  - es.${current.dnsSuffix}
  current:
    fn::invoke:
      Function: aws:getPartition
      Arguments: {}

    Create ManagedUserPoolClient Resource

    new ManagedUserPoolClient(name: string, args: ManagedUserPoolClientArgs, opts?: CustomResourceOptions);
    @overload
def ManagedUserPoolClient(resource_name: str,
                          opts: Optional[ResourceOptions] = None,
                          access_token_validity: Optional[int] = None,
                          allowed_oauth_flows: Optional[Sequence[str]] = None,
                          allowed_oauth_flows_user_pool_client: Optional[bool] = None,
                          allowed_oauth_scopes: Optional[Sequence[str]] = None,
                          analytics_configuration: Optional[ManagedUserPoolClientAnalyticsConfigurationArgs] = None,
                          auth_session_validity: Optional[int] = None,
                          callback_urls: Optional[Sequence[str]] = None,
                          default_redirect_uri: Optional[str] = None,
                          enable_propagate_additional_user_context_data: Optional[bool] = None,
                          enable_token_revocation: Optional[bool] = None,
                          explicit_auth_flows: Optional[Sequence[str]] = None,
                          id_token_validity: Optional[int] = None,
                          logout_urls: Optional[Sequence[str]] = None,
                          name_pattern: Optional[str] = None,
                          name_prefix: Optional[str] = None,
                          prevent_user_existence_errors: Optional[str] = None,
                          read_attributes: Optional[Sequence[str]] = None,
                          refresh_token_validity: Optional[int] = None,
                          supported_identity_providers: Optional[Sequence[str]] = None,
                          token_validity_units: Optional[ManagedUserPoolClientTokenValidityUnitsArgs] = None,
                          user_pool_id: Optional[str] = None,
                          write_attributes: Optional[Sequence[str]] = None)
@overload
def ManagedUserPoolClient(resource_name: str,
                          args: ManagedUserPoolClientArgs,
                          opts: Optional[ResourceOptions] = None)
    func NewManagedUserPoolClient(ctx *Context, name string, args ManagedUserPoolClientArgs, opts ...ResourceOption) (*ManagedUserPoolClient, error)
    public ManagedUserPoolClient(string name, ManagedUserPoolClientArgs args, CustomResourceOptions? opts = null)
    public ManagedUserPoolClient(String name, ManagedUserPoolClientArgs args)
public ManagedUserPoolClient(String name, ManagedUserPoolClientArgs args, CustomResourceOptions options)

    type: aws:cognito:ManagedUserPoolClient
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ManagedUserPoolClientArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ManagedUserPoolClientArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ManagedUserPoolClientArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ManagedUserPoolClientArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ManagedUserPoolClientArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    ManagedUserPoolClient Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The ManagedUserPoolClient resource accepts the following input properties:

    UserPoolId string

    User pool that the client belongs to.

    AccessTokenValidity int

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    AllowedOauthFlows List<string>

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    AllowedOauthFlowsUserPoolClient bool

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    AllowedOauthScopes List<string>

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    AnalyticsConfiguration ManagedUserPoolClientAnalyticsConfiguration

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    AuthSessionValidity int

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    CallbackUrls List<string>

    List of allowed callback URLs for the identity providers.

    DefaultRedirectUri string

    Default redirect URI and must be included in the list of callback URLs.

    EnablePropagateAdditionalUserContextData bool

    Enables the propagation of additional user context data.

    EnableTokenRevocation bool

    Enables or disables token revocation.

    ExplicitAuthFlows List<string>

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    IdTokenValidity int

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    LogoutUrls List<string>

    List of allowed logout URLs for the identity providers.

    NamePattern string

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    NamePrefix string

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    PreventUserExistenceErrors string

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    ReadAttributes List<string>

    List of user pool attributes that the application client can read from.

    RefreshTokenValidity int

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    SupportedIdentityProviders List<string>

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    TokenValidityUnits ManagedUserPoolClientTokenValidityUnits

    Configuration block for representing the validity times in units. See details below. Detailed below.

    WriteAttributes List<string>

    List of user pool attributes that the application client can write to.

    UserPoolId string

    User pool that the client belongs to.

    AccessTokenValidity int

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    AllowedOauthFlows []string

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    AllowedOauthFlowsUserPoolClient bool

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    AllowedOauthScopes []string

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    AnalyticsConfiguration ManagedUserPoolClientAnalyticsConfigurationArgs

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    AuthSessionValidity int

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    CallbackUrls []string

    List of allowed callback URLs for the identity providers.

    DefaultRedirectUri string

    Default redirect URI and must be included in the list of callback URLs.

    EnablePropagateAdditionalUserContextData bool

    Enables the propagation of additional user context data.

    EnableTokenRevocation bool

    Enables or disables token revocation.

    ExplicitAuthFlows []string

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    IdTokenValidity int

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    LogoutUrls []string

    List of allowed logout URLs for the identity providers.

    NamePattern string

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    NamePrefix string

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    PreventUserExistenceErrors string

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    ReadAttributes []string

    List of user pool attributes that the application client can read from.

    RefreshTokenValidity int

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    SupportedIdentityProviders []string

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    TokenValidityUnits ManagedUserPoolClientTokenValidityUnitsArgs

    Configuration block for representing the validity times in units. See details below. Detailed below.

    WriteAttributes []string

    List of user pool attributes that the application client can write to.

    userPoolId String

    User pool that the client belongs to.

    accessTokenValidity Integer

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    allowedOauthFlows List<String>

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    allowedOauthFlowsUserPoolClient Boolean

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    allowedOauthScopes List<String>

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    analyticsConfiguration ManagedUserPoolClientAnalyticsConfiguration

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    authSessionValidity Integer

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    callbackUrls List<String>

    List of allowed callback URLs for the identity providers.

    defaultRedirectUri String

    Default redirect URI and must be included in the list of callback URLs.

    enablePropagateAdditionalUserContextData Boolean

    Enables the propagation of additional user context data.

    enableTokenRevocation Boolean

    Enables or disables token revocation.

    explicitAuthFlows List<String>

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    idTokenValidity Integer

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    logoutUrls List<String>

    List of allowed logout URLs for the identity providers.

    namePattern String

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    namePrefix String

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    preventUserExistenceErrors String

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    readAttributes List<String>

    List of user pool attributes that the application client can read from.

    refreshTokenValidity Integer

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    supportedIdentityProviders List<String>

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    tokenValidityUnits ManagedUserPoolClientTokenValidityUnits

    Configuration block for representing the validity times in units. See details below. Detailed below.

    writeAttributes List<String>

    List of user pool attributes that the application client can write to.

    userPoolId string

    User pool that the client belongs to.

    accessTokenValidity number

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    allowedOauthFlows string[]

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    allowedOauthFlowsUserPoolClient boolean

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    allowedOauthScopes string[]

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    analyticsConfiguration ManagedUserPoolClientAnalyticsConfiguration

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    authSessionValidity number

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    callbackUrls string[]

    List of allowed callback URLs for the identity providers.

    defaultRedirectUri string

    Default redirect URI and must be included in the list of callback URLs.

    enablePropagateAdditionalUserContextData boolean

    Enables the propagation of additional user context data.

    enableTokenRevocation boolean

    Enables or disables token revocation.

    explicitAuthFlows string[]

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    idTokenValidity number

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    logoutUrls string[]

    List of allowed logout URLs for the identity providers.

    namePattern string

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    namePrefix string

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    preventUserExistenceErrors string

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    readAttributes string[]

    List of user pool attributes that the application client can read from.

    refreshTokenValidity number

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    supportedIdentityProviders string[]

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    tokenValidityUnits ManagedUserPoolClientTokenValidityUnits

    Configuration block for representing the validity times in units. See details below. Detailed below.

    writeAttributes string[]

    List of user pool attributes that the application client can write to.

    user_pool_id str

    User pool that the client belongs to.

    access_token_validity int

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    allowed_oauth_flows Sequence[str]

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    allowed_oauth_flows_user_pool_client bool

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    allowed_oauth_scopes Sequence[str]

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    analytics_configuration ManagedUserPoolClientAnalyticsConfigurationArgs

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    auth_session_validity int

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    callback_urls Sequence[str]

    List of allowed callback URLs for the identity providers.

    default_redirect_uri str

    Default redirect URI and must be included in the list of callback URLs.

    enable_propagate_additional_user_context_data bool

    Enables the propagation of additional user context data.

    enable_token_revocation bool

    Enables or disables token revocation.

    explicit_auth_flows Sequence[str]

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    id_token_validity int

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    logout_urls Sequence[str]

    List of allowed logout URLs for the identity providers.

    name_pattern str

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    name_prefix str

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    prevent_user_existence_errors str

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    read_attributes Sequence[str]

    List of user pool attributes that the application client can read from.

    refresh_token_validity int

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    supported_identity_providers Sequence[str]

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    token_validity_units ManagedUserPoolClientTokenValidityUnitsArgs

    Configuration block for representing the validity times in units. See details below. Detailed below.

    write_attributes Sequence[str]

    List of user pool attributes that the application client can write to.

    userPoolId String

    User pool that the client belongs to.

    accessTokenValidity Number

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    allowedOauthFlows List<String>

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    allowedOauthFlowsUserPoolClient Boolean

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    allowedOauthScopes List<String>

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    analyticsConfiguration Property Map

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    authSessionValidity Number

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    callbackUrls List<String>

    List of allowed callback URLs for the identity providers.

    defaultRedirectUri String

    Default redirect URI and must be included in the list of callback URLs.

    enablePropagateAdditionalUserContextData Boolean

    Enables the propagation of additional user context data.

    enableTokenRevocation Boolean

    Enables or disables token revocation.

    explicitAuthFlows List<String>

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    idTokenValidity Number

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    logoutUrls List<String>

    List of allowed logout URLs for the identity providers.

    namePattern String

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    namePrefix String

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    preventUserExistenceErrors String

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    readAttributes List<String>

    List of user pool attributes that the application client can read from.

    refreshTokenValidity Number

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    supportedIdentityProviders List<String>

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    tokenValidityUnits Property Map

    Configuration block for representing the validity times in units. See details below. Detailed below.

    writeAttributes List<String>

    List of user pool attributes that the application client can write to.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ManagedUserPoolClient resource produces the following output properties:

    ClientSecret string

    Client secret of the user pool client.

    Id string

    The provider-assigned unique ID for this managed resource.

    Name string

    Name of the user pool client.

    ClientSecret string

    Client secret of the user pool client.

    Id string

    The provider-assigned unique ID for this managed resource.

    Name string

    Name of the user pool client.

    clientSecret String

    Client secret of the user pool client.

    id String

    The provider-assigned unique ID for this managed resource.

    name String

    Name of the user pool client.

    clientSecret string

    Client secret of the user pool client.

    id string

    The provider-assigned unique ID for this managed resource.

    name string

    Name of the user pool client.

    client_secret str

    Client secret of the user pool client.

    id str

    The provider-assigned unique ID for this managed resource.

    name str

    Name of the user pool client.

    clientSecret String

    Client secret of the user pool client.

    id String

    The provider-assigned unique ID for this managed resource.

    name String

    Name of the user pool client.

    Look up Existing ManagedUserPoolClient Resource

    Get an existing ManagedUserPoolClient resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ManagedUserPoolClientState, opts?: CustomResourceOptions): ManagedUserPoolClient
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access_token_validity: Optional[int] = None,
        allowed_oauth_flows: Optional[Sequence[str]] = None,
        allowed_oauth_flows_user_pool_client: Optional[bool] = None,
        allowed_oauth_scopes: Optional[Sequence[str]] = None,
        analytics_configuration: Optional[ManagedUserPoolClientAnalyticsConfigurationArgs] = None,
        auth_session_validity: Optional[int] = None,
        callback_urls: Optional[Sequence[str]] = None,
        client_secret: Optional[str] = None,
        default_redirect_uri: Optional[str] = None,
        enable_propagate_additional_user_context_data: Optional[bool] = None,
        enable_token_revocation: Optional[bool] = None,
        explicit_auth_flows: Optional[Sequence[str]] = None,
        id_token_validity: Optional[int] = None,
        logout_urls: Optional[Sequence[str]] = None,
        name: Optional[str] = None,
        name_pattern: Optional[str] = None,
        name_prefix: Optional[str] = None,
        prevent_user_existence_errors: Optional[str] = None,
        read_attributes: Optional[Sequence[str]] = None,
        refresh_token_validity: Optional[int] = None,
        supported_identity_providers: Optional[Sequence[str]] = None,
        token_validity_units: Optional[ManagedUserPoolClientTokenValidityUnitsArgs] = None,
        user_pool_id: Optional[str] = None,
        write_attributes: Optional[Sequence[str]] = None) -> ManagedUserPoolClient
    func GetManagedUserPoolClient(ctx *Context, name string, id IDInput, state *ManagedUserPoolClientState, opts ...ResourceOption) (*ManagedUserPoolClient, error)
    public static ManagedUserPoolClient Get(string name, Input<string> id, ManagedUserPoolClientState? state, CustomResourceOptions? opts = null)
    public static ManagedUserPoolClient get(String name, Output<String> id, ManagedUserPoolClientState state, CustomResourceOptions options)
    Resource lookup is not supported in YAML
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccessTokenValidity int

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    AllowedOauthFlows List<string>

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    AllowedOauthFlowsUserPoolClient bool

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    AllowedOauthScopes List<string>

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    AnalyticsConfiguration ManagedUserPoolClientAnalyticsConfiguration

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    AuthSessionValidity int

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    CallbackUrls List<string>

    List of allowed callback URLs for the identity providers.

    ClientSecret string

    Client secret of the user pool client.

    DefaultRedirectUri string

    Default redirect URI and must be included in the list of callback URLs.

    EnablePropagateAdditionalUserContextData bool

    Enables the propagation of additional user context data.

    EnableTokenRevocation bool

    Enables or disables token revocation.

    ExplicitAuthFlows List<string>

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    IdTokenValidity int

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    LogoutUrls List<string>

    List of allowed logout URLs for the identity providers.

    Name string

    Name of the user pool client.

    NamePattern string

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    NamePrefix string

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    PreventUserExistenceErrors string

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    ReadAttributes List<string>

    List of user pool attributes that the application client can read from.

    RefreshTokenValidity int

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    SupportedIdentityProviders List<string>

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    TokenValidityUnits ManagedUserPoolClientTokenValidityUnits

    Configuration block for representing the validity times in units. See details below. Detailed below.

    UserPoolId string

    User pool that the client belongs to.

    WriteAttributes List<string>

    List of user pool attributes that the application client can write to.

    AccessTokenValidity int

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    AllowedOauthFlows []string

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    AllowedOauthFlowsUserPoolClient bool

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    AllowedOauthScopes []string

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    AnalyticsConfiguration ManagedUserPoolClientAnalyticsConfigurationArgs

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    AuthSessionValidity int

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    CallbackUrls []string

    List of allowed callback URLs for the identity providers.

    ClientSecret string

    Client secret of the user pool client.

    DefaultRedirectUri string

    Default redirect URI and must be included in the list of callback URLs.

    EnablePropagateAdditionalUserContextData bool

    Enables the propagation of additional user context data.

    EnableTokenRevocation bool

    Enables or disables token revocation.

    ExplicitAuthFlows []string

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    IdTokenValidity int

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    LogoutUrls []string

    List of allowed logout URLs for the identity providers.

    Name string

    Name of the user pool client.

    NamePattern string

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    NamePrefix string

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    PreventUserExistenceErrors string

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    ReadAttributes []string

    List of user pool attributes that the application client can read from.

    RefreshTokenValidity int

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    SupportedIdentityProviders []string

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    TokenValidityUnits ManagedUserPoolClientTokenValidityUnitsArgs

    Configuration block for representing the validity times in units. See details below. Detailed below.

    UserPoolId string

    User pool that the client belongs to.

    WriteAttributes []string

    List of user pool attributes that the application client can write to.

    accessTokenValidity Integer

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    allowedOauthFlows List<String>

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    allowedOauthFlowsUserPoolClient Boolean

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    allowedOauthScopes List<String>

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    analyticsConfiguration ManagedUserPoolClientAnalyticsConfiguration

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    authSessionValidity Integer

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    callbackUrls List<String>

    List of allowed callback URLs for the identity providers.

    clientSecret String

    Client secret of the user pool client.

    defaultRedirectUri String

    Default redirect URI and must be included in the list of callback URLs.

    enablePropagateAdditionalUserContextData Boolean

    Enables the propagation of additional user context data.

    enableTokenRevocation Boolean

    Enables or disables token revocation.

    explicitAuthFlows List<String>

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    idTokenValidity Integer

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    logoutUrls List<String>

    List of allowed logout URLs for the identity providers.

    name String

    Name of the user pool client.

    namePattern String

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    namePrefix String

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    preventUserExistenceErrors String

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    readAttributes List<String>

    List of user pool attributes that the application client can read from.

    refreshTokenValidity Integer

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    supportedIdentityProviders List<String>

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    tokenValidityUnits ManagedUserPoolClientTokenValidityUnits

    Configuration block for representing the validity times in units. See details below. Detailed below.

    userPoolId String

    User pool that the client belongs to.

    writeAttributes List<String>

    List of user pool attributes that the application client can write to.

    accessTokenValidity number

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    allowedOauthFlows string[]

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    allowedOauthFlowsUserPoolClient boolean

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    allowedOauthScopes string[]

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    analyticsConfiguration ManagedUserPoolClientAnalyticsConfiguration

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    authSessionValidity number

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    callbackUrls string[]

    List of allowed callback URLs for the identity providers.

    clientSecret string

    Client secret of the user pool client.

    defaultRedirectUri string

    Default redirect URI and must be included in the list of callback URLs.

    enablePropagateAdditionalUserContextData boolean

    Enables the propagation of additional user context data.

    enableTokenRevocation boolean

    Enables or disables token revocation.

    explicitAuthFlows string[]

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    idTokenValidity number

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    logoutUrls string[]

    List of allowed logout URLs for the identity providers.

    name string

    Name of the user pool client.

    namePattern string

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    namePrefix string

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    preventUserExistenceErrors string

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    readAttributes string[]

    List of user pool attributes that the application client can read from.

    refreshTokenValidity number

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    supportedIdentityProviders string[]

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    tokenValidityUnits ManagedUserPoolClientTokenValidityUnits

    Configuration block for representing the validity times in units. See details below. Detailed below.

    userPoolId string

    User pool that the client belongs to.

    writeAttributes string[]

    List of user pool attributes that the application client can write to.

    access_token_validity int

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    allowed_oauth_flows Sequence[str]

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    allowed_oauth_flows_user_pool_client bool

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    allowed_oauth_scopes Sequence[str]

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    analytics_configuration ManagedUserPoolClientAnalyticsConfigurationArgs

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    auth_session_validity int

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    callback_urls Sequence[str]

    List of allowed callback URLs for the identity providers.

    client_secret str

    Client secret of the user pool client.

    default_redirect_uri str

    Default redirect URI and must be included in the list of callback URLs.

    enable_propagate_additional_user_context_data bool

    Enables the propagation of additional user context data.

    enable_token_revocation bool

    Enables or disables token revocation.

    explicit_auth_flows Sequence[str]

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    id_token_validity int

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    logout_urls Sequence[str]

    List of allowed logout URLs for the identity providers.

    name str

    Name of the user pool client.

    name_pattern str

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    name_prefix str

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    prevent_user_existence_errors str

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    read_attributes Sequence[str]

    List of user pool attributes that the application client can read from.

    refresh_token_validity int

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    supported_identity_providers Sequence[str]

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    token_validity_units ManagedUserPoolClientTokenValidityUnitsArgs

    Configuration block for representing the validity times in units. See details below. Detailed below.

    user_pool_id str

    User pool that the client belongs to.

    write_attributes Sequence[str]

    List of user pool attributes that the application client can write to.

    accessTokenValidity Number

    Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.access_token.

    allowedOauthFlows List<String>

    List of allowed OAuth flows, including code, implicit, and client_credentials.

    allowedOauthFlowsUserPoolClient Boolean

    Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.

    allowedOauthScopes List<String>

    List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.

    analyticsConfiguration Property Map

    Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.

    authSessionValidity Number

    Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for auth_session_validity are between 3 and 15, with a default value of 3.

    callbackUrls List<String>

    List of allowed callback URLs for the identity providers.

    clientSecret String

    Client secret of the user pool client.

    defaultRedirectUri String

    Default redirect URI and must be included in the list of callback URLs.

    enablePropagateAdditionalUserContextData Boolean

    Enables the propagation of additional user context data.

    enableTokenRevocation Boolean

    Enables or disables token revocation.

    explicitAuthFlows List<String>

    List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

    idTokenValidity Number

    Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in token_validity_units.id_token.

    logoutUrls List<String>

    List of allowed logout URLs for the identity providers.

    name String

    Name of the user pool client.

    namePattern String

    Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.

    namePrefix String

    String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.

    The following arguments are optional:

    preventUserExistenceErrors String

    Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

    readAttributes List<String>

    List of user pool attributes that the application client can read from.

    refreshTokenValidity Number

    Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in token_validity_units.refresh_token.

    supportedIdentityProviders List<String>

    List of provider names for the identity providers that are supported on this client. It uses the provider_name attribute of the aws.cognito.IdentityProvider resource(s), or the equivalent string(s).

    tokenValidityUnits Property Map

    Configuration block for representing the validity times in units. See details below. Detailed below.

    userPoolId String

    User pool that the client belongs to.

    writeAttributes List<String>

    List of user pool attributes that the application client can write to.

    Supporting Types

    ManagedUserPoolClientAnalyticsConfiguration, ManagedUserPoolClientAnalyticsConfigurationArgs

    ApplicationArn string

    Application ARN for an Amazon Pinpoint application. It conflicts with external_id and role_arn.

    ApplicationId string

    Unique identifier for an Amazon Pinpoint application.

    ExternalId string

    ID for the Analytics Configuration and conflicts with application_arn.

    RoleArn string

    ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. It conflicts with application_arn.

    UserDataShared bool

    If user_data_shared is set to true, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.

    ApplicationArn string

    Application ARN for an Amazon Pinpoint application. It conflicts with external_id and role_arn.

    ApplicationId string

    Unique identifier for an Amazon Pinpoint application.

    ExternalId string

    ID for the Analytics Configuration and conflicts with application_arn.

    RoleArn string

    ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. It conflicts with application_arn.

    UserDataShared bool

    If user_data_shared is set to true, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.

    applicationArn String

    Application ARN for an Amazon Pinpoint application. It conflicts with external_id and role_arn.

    applicationId String

    Unique identifier for an Amazon Pinpoint application.

    externalId String

    ID for the Analytics Configuration and conflicts with application_arn.

    roleArn String

    ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. It conflicts with application_arn.

    userDataShared Boolean

    If user_data_shared is set to true, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.

    applicationArn string

    Application ARN for an Amazon Pinpoint application. It conflicts with external_id and role_arn.

    applicationId string

    Unique identifier for an Amazon Pinpoint application.

    externalId string

    ID for the Analytics Configuration and conflicts with application_arn.

    roleArn string

    ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. It conflicts with application_arn.

    userDataShared boolean

    If user_data_shared is set to true, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.

    application_arn str

    Application ARN for an Amazon Pinpoint application. It conflicts with external_id and role_arn.

    application_id str

    Unique identifier for an Amazon Pinpoint application.

    external_id str

    ID for the Analytics Configuration and conflicts with application_arn.

    role_arn str

    ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. It conflicts with application_arn.

    user_data_shared bool

    If user_data_shared is set to true, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.

    applicationArn String

    Application ARN for an Amazon Pinpoint application. It conflicts with external_id and role_arn.

    applicationId String

    Unique identifier for an Amazon Pinpoint application.

    externalId String

    ID for the Analytics Configuration and conflicts with application_arn.

    roleArn String

    ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. It conflicts with application_arn.

    userDataShared Boolean

    If user_data_shared is set to true, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.

    ManagedUserPoolClientTokenValidityUnits, ManagedUserPoolClientTokenValidityUnitsArgs

    AccessToken string

    Time unit for the value in access_token_validity and defaults to hours.

    IdToken string

    Time unit for the value in id_token_validity, and it defaults to hours.

    RefreshToken string

    Time unit for the value in refresh_token_validity and defaults to days.

    AccessToken string

    Time unit for the value in access_token_validity and defaults to hours.

    IdToken string

    Time unit for the value in id_token_validity, and it defaults to hours.

    RefreshToken string

    Time unit for the value in refresh_token_validity and defaults to days.

    accessToken String

    Time unit for the value in access_token_validity and defaults to hours.

    idToken String

    Time unit for the value in id_token_validity, and it defaults to hours.

    refreshToken String

    Time unit for the value in refresh_token_validity and defaults to days.

    accessToken string

    Time unit for the value in access_token_validity and defaults to hours.

    idToken string

    Time unit for the value in id_token_validity, and it defaults to hours.

    refreshToken string

    Time unit for the value in refresh_token_validity and defaults to days.

    access_token str

    Time unit for the value in access_token_validity and defaults to hours.

    id_token str

    Time unit for the value in id_token_validity, and it defaults to hours.

    refresh_token str

    Time unit for the value in refresh_token_validity and defaults to days.

    accessToken String

    Time unit for the value in access_token_validity and defaults to hours.

    idToken String

    Time unit for the value in id_token_validity, and it defaults to hours.

    refreshToken String

    Time unit for the value in refresh_token_validity and defaults to days.

    Import

    Using pulumi import, import Cognito User Pool Clients using the id of the Cognito User Pool and the id of the Cognito User Pool Client. For example:

     $ pulumi import aws:cognito/managedUserPoolClient:ManagedUserPoolClient client us-west-2_abc123/3ho4ek12345678909nh3fmhpko

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes

    This Pulumi package is based on the aws Terraform Provider.

    aws logo

    Try AWS Native preview for resources not in the classic version.

    AWS Classic v6.13.1 published on Tuesday, Dec 5, 2023 by Pulumi
    pulumi/pulumi-aws