Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. AWS
  4. API Docs
  5. verifiedpermissions
  6. IdentitySource
Viewing docs for AWS v7.50.0
published on Thursday, Oct 8, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.verifiedpermissions.IdentitySource

aws logo aws logo
Viewing docs for AWS v7.50.0
published on Thursday, Oct 8, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Resource for managing an AWS Verified Permissions Identity Source.

    Example Usage

    Cognito User Pool Configuration Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.verifiedpermissions.PolicyStore("example", {validationSettings: {
    mode: "STRICT",
}});
const exampleUserPool = new aws.cognito.UserPool("example", {name: "example"});
const exampleUserPoolClient = new aws.cognito.UserPoolClient("example", {
    name: "example",
    userPoolId: exampleUserPool.id,
    explicitAuthFlows: ["ADMIN_NO_SRP_AUTH"],
});
const exampleIdentitySource = new aws.verifiedpermissions.IdentitySource("example", {
    configuration: {
        cognitoUserPoolConfiguration: {
            userPoolArn: exampleUserPool.arn,
            clientIds: [exampleUserPoolClient.id],
        },
    },
    policyStoreId: example.id,
});

    import pulumi
import pulumi_aws as aws

example = aws.verifiedpermissions.PolicyStore("example", validation_settings={
    "mode": "STRICT",
})
example_user_pool = aws.cognito.UserPool("example", name="example")
example_user_pool_client = aws.cognito.UserPoolClient("example",
    name="example",
    user_pool_id=example_user_pool.id,
    explicit_auth_flows=["ADMIN_NO_SRP_AUTH"])
example_identity_source = aws.verifiedpermissions.IdentitySource("example",
    configuration={
        "cognito_user_pool_configuration": {
            "user_pool_arn": example_user_pool.arn,
            "client_ids": [example_user_pool_client.id],
        },
    },
    policy_store_id=example.id)

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cognito"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/verifiedpermissions"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := verifiedpermissions.NewPolicyStore(ctx, "example", &verifiedpermissions.PolicyStoreArgs{
			ValidationSettings: &verifiedpermissions.PolicyStoreValidationSettingsArgs{
				Mode: pulumi.String("STRICT"),
			},
		})
		if err != nil {
			return err
		}
		exampleUserPool, err := cognito.NewUserPool(ctx, "example", &cognito.UserPoolArgs{
			Name: pulumi.String("example"),
		})
		if err != nil {
			return err
		}
		exampleUserPoolClient, err := cognito.NewUserPoolClient(ctx, "example", &cognito.UserPoolClientArgs{
			Name:       pulumi.String("example"),
			UserPoolId: exampleUserPool.ID().ToIDOutput().ToStringOutput(),
			ExplicitAuthFlows: pulumi.StringArray{
				pulumi.String("ADMIN_NO_SRP_AUTH"),
			},
		})
		if err != nil {
			return err
		}
		_, err = verifiedpermissions.NewIdentitySource(ctx, "example", &verifiedpermissions.IdentitySourceArgs{
			Configuration: &verifiedpermissions.IdentitySourceConfigurationArgs{
				CognitoUserPoolConfiguration: &verifiedpermissions.IdentitySourceConfigurationCognitoUserPoolConfigurationArgs{
					UserPoolArn: exampleUserPool.Arn,
					ClientIds: pulumi.StringArray{
						exampleUserPoolClient.ID().ToIDOutput().ToStringOutput(),
					},
				},
			},
			PolicyStoreId: example.ID().ToIDOutput().ToStringOutput(),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.VerifiedPermissions.PolicyStore("example", new()
    {
        ValidationSettings = new Aws.VerifiedPermissions.Inputs.PolicyStoreValidationSettingsArgs
        {
            Mode = "STRICT",
        },
    });

    var exampleUserPool = new Aws.Cognito.UserPool("example", new()
    {
        Name = "example",
    });

    var exampleUserPoolClient = new Aws.Cognito.UserPoolClient("example", new()
    {
        Name = "example",
        UserPoolId = exampleUserPool.Id,
        ExplicitAuthFlows = new[]
        {
            "ADMIN_NO_SRP_AUTH",
        },
    });

    var exampleIdentitySource = new Aws.VerifiedPermissions.IdentitySource("example", new()
    {
        Configuration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationArgs
        {
            CognitoUserPoolConfiguration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationCognitoUserPoolConfigurationArgs
            {
                UserPoolArn = exampleUserPool.Arn,
                ClientIds = new[]
                {
                    exampleUserPoolClient.Id,
                },
            },
        },
        PolicyStoreId = example.Id,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.verifiedpermissions.PolicyStore;
import com.pulumi.aws.verifiedpermissions.PolicyStoreArgs;
import com.pulumi.aws.verifiedpermissions.inputs.PolicyStoreValidationSettingsArgs;
import com.pulumi.aws.cognito.UserPool;
import com.pulumi.aws.cognito.UserPoolArgs;
import com.pulumi.aws.cognito.UserPoolClient;
import com.pulumi.aws.cognito.UserPoolClientArgs;
import com.pulumi.aws.verifiedpermissions.IdentitySource;
import com.pulumi.aws.verifiedpermissions.IdentitySourceArgs;
import com.pulumi.aws.verifiedpermissions.inputs.IdentitySourceConfigurationArgs;
import com.pulumi.aws.verifiedpermissions.inputs.IdentitySourceConfigurationCognitoUserPoolConfigurationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new PolicyStore("example", PolicyStoreArgs.builder()
            .validationSettings(PolicyStoreValidationSettingsArgs.builder()
                .mode("STRICT")
                .build())
            .build());

        var exampleUserPool = new UserPool("exampleUserPool", UserPoolArgs.builder()
            .name("example")
            .build());

        var exampleUserPoolClient = new UserPoolClient("exampleUserPoolClient", UserPoolClientArgs.builder()
            .name("example")
            .userPoolId(exampleUserPool.id())
            .explicitAuthFlows("ADMIN_NO_SRP_AUTH")
            .build());

        var exampleIdentitySource = new IdentitySource("exampleIdentitySource", IdentitySourceArgs.builder()
            .configuration(IdentitySourceConfigurationArgs.builder()
                .cognitoUserPoolConfiguration(IdentitySourceConfigurationCognitoUserPoolConfigurationArgs.builder()
                    .userPoolArn(exampleUserPool.arn())
                    .clientIds(exampleUserPoolClient.id())
                    .build())
                .build())
            .policyStoreId(example.id())
            .build());

    }
}

    resources:
  example:
    type: aws:verifiedpermissions:PolicyStore
    properties:
      validationSettings:
        mode: STRICT
  exampleUserPool:
    type: aws:cognito:UserPool
    name: example
    properties:
      name: example
  exampleUserPoolClient:
    type: aws:cognito:UserPoolClient
    name: example
    properties:
      name: example
      userPoolId: ${exampleUserPool.id}
      explicitAuthFlows:
        - ADMIN_NO_SRP_AUTH
  exampleIdentitySource:
    type: aws:verifiedpermissions:IdentitySource
    name: example
    properties:
      configuration:
        cognitoUserPoolConfiguration:
          userPoolArn: ${exampleUserPool.arn}
          clientIds:
            - ${exampleUserPoolClient.id}
      policyStoreId: ${example.id}

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_verifiedpermissions_policystore" "example" {
  validation_settings = {
    mode = "STRICT"
  }
}
resource "aws_cognito_userpool" "example" {
  name = "example"
}
resource "aws_cognito_userpoolclient" "example" {
  name                = "example"
  user_pool_id        = aws_cognito_userpool.example.id
  explicit_auth_flows = ["ADMIN_NO_SRP_AUTH"]
}
resource "aws_verifiedpermissions_identitysource" "example" {
  configuration = {
    cognito_user_pool_configuration = {
      user_pool_arn = aws_cognito_userpool.example.arn
      client_ids    = [aws_cognito_userpoolclient.example.id]
    }
  }
  policy_store_id = aws_verifiedpermissions_policystore.example.id
}

    OpenID Connect Configuration Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.verifiedpermissions.PolicyStore("example", {validationSettings: {
    mode: "STRICT",
}});
const exampleIdentitySource = new aws.verifiedpermissions.IdentitySource("example", {
    configuration: {
        openIdConnectConfiguration: {
            tokenSelection: {
                accessTokenOnly: {
                    audiences: ["https://myapp.example.com"],
                    principalIdClaim: "sub",
                },
            },
            groupConfiguration: {
                groupClaim: "groups",
                groupEntityType: "MyCorp::UserGroup",
            },
            issuer: "https://auth.example.com",
            entityIdPrefix: "MyOIDCProvider",
        },
    },
    policyStoreId: example.id,
    principalEntityType: "MyCorp::User",
});

    import pulumi
import pulumi_aws as aws

example = aws.verifiedpermissions.PolicyStore("example", validation_settings={
    "mode": "STRICT",
})
example_identity_source = aws.verifiedpermissions.IdentitySource("example",
    configuration={
        "open_id_connect_configuration": {
            "token_selection": {
                "access_token_only": {
                    "audiences": ["https://myapp.example.com"],
                    "principal_id_claim": "sub",
                },
            },
            "group_configuration": {
                "group_claim": "groups",
                "group_entity_type": "MyCorp::UserGroup",
            },
            "issuer": "https://auth.example.com",
            "entity_id_prefix": "MyOIDCProvider",
        },
    },
    policy_store_id=example.id,
    principal_entity_type="MyCorp::User")

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/verifiedpermissions"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := verifiedpermissions.NewPolicyStore(ctx, "example", &verifiedpermissions.PolicyStoreArgs{
			ValidationSettings: &verifiedpermissions.PolicyStoreValidationSettingsArgs{
				Mode: pulumi.String("STRICT"),
			},
		})
		if err != nil {
			return err
		}
		_, err = verifiedpermissions.NewIdentitySource(ctx, "example", &verifiedpermissions.IdentitySourceArgs{
			Configuration: &verifiedpermissions.IdentitySourceConfigurationArgs{
				OpenIdConnectConfiguration: &verifiedpermissions.IdentitySourceConfigurationOpenIdConnectConfigurationArgs{
					TokenSelection: &verifiedpermissions.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionArgs{
						AccessTokenOnly: &verifiedpermissions.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnlyArgs{
							Audiences: pulumi.StringArray{
								pulumi.String("https://myapp.example.com"),
							},
							PrincipalIdClaim: pulumi.String("sub"),
						},
					},
					GroupConfiguration: &verifiedpermissions.IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfigurationArgs{
						GroupClaim:      pulumi.String("groups"),
						GroupEntityType: pulumi.String("MyCorp::UserGroup"),
					},
					Issuer:         pulumi.String("https://auth.example.com"),
					EntityIdPrefix: pulumi.String("MyOIDCProvider"),
				},
			},
			PolicyStoreId:       example.ID().ToIDOutput().ToStringOutput(),
			PrincipalEntityType: pulumi.String("MyCorp::User"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.VerifiedPermissions.PolicyStore("example", new()
    {
        ValidationSettings = new Aws.VerifiedPermissions.Inputs.PolicyStoreValidationSettingsArgs
        {
            Mode = "STRICT",
        },
    });

    var exampleIdentitySource = new Aws.VerifiedPermissions.IdentitySource("example", new()
    {
        Configuration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationArgs
        {
            OpenIdConnectConfiguration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationOpenIdConnectConfigurationArgs
            {
                TokenSelection = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionArgs
                {
                    AccessTokenOnly = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnlyArgs
                    {
                        Audiences = new[]
                        {
                            "https://myapp.example.com",
                        },
                        PrincipalIdClaim = "sub",
                    },
                },
                GroupConfiguration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfigurationArgs
                {
                    GroupClaim = "groups",
                    GroupEntityType = "MyCorp::UserGroup",
                },
                Issuer = "https://auth.example.com",
                EntityIdPrefix = "MyOIDCProvider",
            },
        },
        PolicyStoreId = example.Id,
        PrincipalEntityType = "MyCorp::User",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.verifiedpermissions.PolicyStore;
import com.pulumi.aws.verifiedpermissions.PolicyStoreArgs;
import com.pulumi.aws.verifiedpermissions.inputs.PolicyStoreValidationSettingsArgs;
import com.pulumi.aws.verifiedpermissions.IdentitySource;
import com.pulumi.aws.verifiedpermissions.IdentitySourceArgs;
import com.pulumi.aws.verifiedpermissions.inputs.IdentitySourceConfigurationArgs;
import com.pulumi.aws.verifiedpermissions.inputs.IdentitySourceConfigurationOpenIdConnectConfigurationArgs;
import com.pulumi.aws.verifiedpermissions.inputs.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionArgs;
import com.pulumi.aws.verifiedpermissions.inputs.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnlyArgs;
import com.pulumi.aws.verifiedpermissions.inputs.IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfigurationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new PolicyStore("example", PolicyStoreArgs.builder()
            .validationSettings(PolicyStoreValidationSettingsArgs.builder()
                .mode("STRICT")
                .build())
            .build());

        var exampleIdentitySource = new IdentitySource("exampleIdentitySource", IdentitySourceArgs.builder()
            .configuration(IdentitySourceConfigurationArgs.builder()
                .openIdConnectConfiguration(IdentitySourceConfigurationOpenIdConnectConfigurationArgs.builder()
                    .tokenSelection(IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionArgs.builder()
                        .accessTokenOnly(IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnlyArgs.builder()
                            .audiences("https://myapp.example.com")
                            .principalIdClaim("sub")
                            .build())
                        .build())
                    .groupConfiguration(IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfigurationArgs.builder()
                        .groupClaim("groups")
                        .groupEntityType("MyCorp::UserGroup")
                        .build())
                    .issuer("https://auth.example.com")
                    .entityIdPrefix("MyOIDCProvider")
                    .build())
                .build())
            .policyStoreId(example.id())
            .principalEntityType("MyCorp::User")
            .build());

    }
}

    resources:
  example:
    type: aws:verifiedpermissions:PolicyStore
    properties:
      validationSettings:
        mode: STRICT
  exampleIdentitySource:
    type: aws:verifiedpermissions:IdentitySource
    name: example
    properties:
      configuration:
        openIdConnectConfiguration:
          tokenSelection:
            accessTokenOnly:
              audiences:
                - https://myapp.example.com
              principalIdClaim: sub
          groupConfiguration:
            groupClaim: groups
            groupEntityType: MyCorp::UserGroup
          issuer: https://auth.example.com
          entityIdPrefix: MyOIDCProvider
      policyStoreId: ${example.id}
      principalEntityType: MyCorp::User

    pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_verifiedpermissions_policystore" "example" {
  validation_settings = {
    mode = "STRICT"
  }
}
resource "aws_verifiedpermissions_identitysource" "example" {
  configuration = {
    open_id_connect_configuration = {
      token_selection = {
        access_token_only = {
          audiences          = ["https://myapp.example.com"]
          principal_id_claim = "sub"
        }
      }
      group_configuration = {
        group_claim       = "groups"
        group_entity_type = "MyCorp::UserGroup"
      }
      issuer           = "https://auth.example.com"
      entity_id_prefix = "MyOIDCProvider"
    }
  }
  policy_store_id       = aws_verifiedpermissions_policystore.example.id
  principal_entity_type = "MyCorp::User"
}

    Create IdentitySource Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new IdentitySource(name: string, args: IdentitySourceArgs, opts?: CustomResourceOptions);
    @overload
def IdentitySource(resource_name: str,
                   args: IdentitySourceArgs,
                   opts: Optional[ResourceOptions] = None)

@overload
def IdentitySource(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   configuration: Optional[IdentitySourceConfigurationArgs] = None,
                   policy_store_id: Optional[str] = None,
                   principal_entity_type: Optional[str] = None,
                   region: Optional[str] = None)
    func NewIdentitySource(ctx *Context, name string, args IdentitySourceArgs, opts ...ResourceOption) (*IdentitySource, error)
    public IdentitySource(string name, IdentitySourceArgs args, CustomResourceOptions? opts = null)
    public IdentitySource(String name, IdentitySourceArgs args)
public IdentitySource(String name, IdentitySourceArgs args, CustomResourceOptions options)

    type: aws:verifiedpermissions:IdentitySource
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws_verifiedpermissions_identity_source" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args IdentitySourceArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args IdentitySourceArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args IdentitySourceArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args IdentitySourceArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args IdentitySourceArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var identitySourceResource = new Aws.VerifiedPermissions.IdentitySource("identitySourceResource", new()
{
    Configuration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationArgs
    {
        CognitoUserPoolConfiguration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationCognitoUserPoolConfigurationArgs
        {
            UserPoolArn = "string",
            ClientIds = new[]
            {
                "string",
            },
            GroupConfiguration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfigurationArgs
            {
                GroupEntityType = "string",
            },
        },
        OpenIdConnectConfiguration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationOpenIdConnectConfigurationArgs
        {
            Issuer = "string",
            TokenSelection = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionArgs
            {
                AccessTokenOnly = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnlyArgs
                {
                    Audiences = new[]
                    {
                        "string",
                    },
                    PrincipalIdClaim = "string",
                },
                IdentityTokenOnly = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnlyArgs
                {
                    ClientIds = new[]
                    {
                        "string",
                    },
                    PrincipalIdClaim = "string",
                },
            },
            EntityIdPrefix = "string",
            GroupConfiguration = new Aws.VerifiedPermissions.Inputs.IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfigurationArgs
            {
                GroupClaim = "string",
                GroupEntityType = "string",
            },
        },
    },
    PolicyStoreId = "string",
    PrincipalEntityType = "string",
    Region = "string",
});

    example, err := verifiedpermissions.NewIdentitySource(ctx, "identitySourceResource", &verifiedpermissions.IdentitySourceArgs{
	Configuration: &verifiedpermissions.IdentitySourceConfigurationArgs{
		CognitoUserPoolConfiguration: &verifiedpermissions.IdentitySourceConfigurationCognitoUserPoolConfigurationArgs{
			UserPoolArn: pulumi.String("string"),
			ClientIds: pulumi.StringArray{
				pulumi.String("string"),
			},
			GroupConfiguration: &verifiedpermissions.IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfigurationArgs{
				GroupEntityType: pulumi.String("string"),
			},
		},
		OpenIdConnectConfiguration: &verifiedpermissions.IdentitySourceConfigurationOpenIdConnectConfigurationArgs{
			Issuer: pulumi.String("string"),
			TokenSelection: &verifiedpermissions.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionArgs{
				AccessTokenOnly: &verifiedpermissions.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnlyArgs{
					Audiences: pulumi.StringArray{
						pulumi.String("string"),
					},
					PrincipalIdClaim: pulumi.String("string"),
				},
				IdentityTokenOnly: &verifiedpermissions.IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnlyArgs{
					ClientIds: pulumi.StringArray{
						pulumi.String("string"),
					},
					PrincipalIdClaim: pulumi.String("string"),
				},
			},
			EntityIdPrefix: pulumi.String("string"),
			GroupConfiguration: &verifiedpermissions.IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfigurationArgs{
				GroupClaim:      pulumi.String("string"),
				GroupEntityType: pulumi.String("string"),
			},
		},
	},
	PolicyStoreId:       pulumi.String("string"),
	PrincipalEntityType: pulumi.String("string"),
	Region:              pulumi.String("string"),
})

    resource "aws_verifiedpermissions_identity_source" "identitySourceResource" {
  lifecycle {
    create_before_destroy = true
  }
  configuration = {
    cognito_user_pool_configuration = {
      user_pool_arn = "string"
      client_ids    = ["string"]
      group_configuration = {
        group_entity_type = "string"
      }
    }
    open_id_connect_configuration = {
      issuer = "string"
      token_selection = {
        access_token_only = {
          audiences          = ["string"]
          principal_id_claim = "string"
        }
        identity_token_only = {
          client_ids         = ["string"]
          principal_id_claim = "string"
        }
      }
      entity_id_prefix = "string"
      group_configuration = {
        group_claim       = "string"
        group_entity_type = "string"
      }
    }
  }
  policy_store_id       = "string"
  principal_entity_type = "string"
  region                = "string"
}

    var identitySourceResource = new IdentitySource("identitySourceResource", IdentitySourceArgs.builder()
    .configuration(IdentitySourceConfigurationArgs.builder()
        .cognitoUserPoolConfiguration(IdentitySourceConfigurationCognitoUserPoolConfigurationArgs.builder()
            .userPoolArn("string")
            .clientIds("string")
            .groupConfiguration(IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfigurationArgs.builder()
                .groupEntityType("string")
                .build())
            .build())
        .openIdConnectConfiguration(IdentitySourceConfigurationOpenIdConnectConfigurationArgs.builder()
            .issuer("string")
            .tokenSelection(IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionArgs.builder()
                .accessTokenOnly(IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnlyArgs.builder()
                    .audiences("string")
                    .principalIdClaim("string")
                    .build())
                .identityTokenOnly(IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnlyArgs.builder()
                    .clientIds("string")
                    .principalIdClaim("string")
                    .build())
                .build())
            .entityIdPrefix("string")
            .groupConfiguration(IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfigurationArgs.builder()
                .groupClaim("string")
                .groupEntityType("string")
                .build())
            .build())
        .build())
    .policyStoreId("string")
    .principalEntityType("string")
    .region("string")
    .build());

    identity_source_resource = aws.verifiedpermissions.IdentitySource("identitySourceResource",
    configuration={
        "cognito_user_pool_configuration": {
            "user_pool_arn": "string",
            "client_ids": ["string"],
            "group_configuration": {
                "group_entity_type": "string",
            },
        },
        "open_id_connect_configuration": {
            "issuer": "string",
            "token_selection": {
                "access_token_only": {
                    "audiences": ["string"],
                    "principal_id_claim": "string",
                },
                "identity_token_only": {
                    "client_ids": ["string"],
                    "principal_id_claim": "string",
                },
            },
            "entity_id_prefix": "string",
            "group_configuration": {
                "group_claim": "string",
                "group_entity_type": "string",
            },
        },
    },
    policy_store_id="string",
    principal_entity_type="string",
    region="string")

    const identitySourceResource = new aws.verifiedpermissions.IdentitySource("identitySourceResource", {
    configuration: {
        cognitoUserPoolConfiguration: {
            userPoolArn: "string",
            clientIds: ["string"],
            groupConfiguration: {
                groupEntityType: "string",
            },
        },
        openIdConnectConfiguration: {
            issuer: "string",
            tokenSelection: {
                accessTokenOnly: {
                    audiences: ["string"],
                    principalIdClaim: "string",
                },
                identityTokenOnly: {
                    clientIds: ["string"],
                    principalIdClaim: "string",
                },
            },
            entityIdPrefix: "string",
            groupConfiguration: {
                groupClaim: "string",
                groupEntityType: "string",
            },
        },
    },
    policyStoreId: "string",
    principalEntityType: "string",
    region: "string",
});

    type: aws:verifiedpermissions:IdentitySource
properties:
    configuration:
        cognitoUserPoolConfiguration:
            clientIds:
                - string
            groupConfiguration:
                groupEntityType: string
            userPoolArn: string
        openIdConnectConfiguration:
            entityIdPrefix: string
            groupConfiguration:
                groupClaim: string
                groupEntityType: string
            issuer: string
            tokenSelection:
                accessTokenOnly:
                    audiences:
                        - string
                    principalIdClaim: string
                identityTokenOnly:
                    clientIds:
                        - string
                    principalIdClaim: string
    policyStoreId: string
    principalEntityType: string
    region: string

    IdentitySource Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The IdentitySource resource accepts the following input properties:

    Configuration IdentitySourceConfiguration
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    PolicyStoreId string
    ID of the policy store in which you want to store this identity source.
    PrincipalEntityType string
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Configuration IdentitySourceConfigurationArgs
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    PolicyStoreId string
    ID of the policy store in which you want to store this identity source.
    PrincipalEntityType string
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration object
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policy_store_id string
    ID of the policy store in which you want to store this identity source.
    principal_entity_type string
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration IdentitySourceConfiguration
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policyStoreId String
    ID of the policy store in which you want to store this identity source.
    principalEntityType String
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration IdentitySourceConfiguration
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policyStoreId string
    ID of the policy store in which you want to store this identity source.
    principalEntityType string
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration IdentitySourceConfigurationArgs
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policy_store_id str
    ID of the policy store in which you want to store this identity source.
    principal_entity_type str
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration Property Map
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policyStoreId String
    ID of the policy store in which you want to store this identity source.
    principalEntityType String
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the IdentitySource resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing IdentitySource Resource

    Get an existing IdentitySource resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: IdentitySourceState, opts?: CustomResourceOptions): IdentitySource
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        configuration: Optional[IdentitySourceConfigurationArgs] = None,
        policy_store_id: Optional[str] = None,
        principal_entity_type: Optional[str] = None,
        region: Optional[str] = None) -> IdentitySource
    func GetIdentitySource(ctx *Context, name string, id IDInput, state *IdentitySourceState, opts ...ResourceOption) (*IdentitySource, error)
    public static IdentitySource Get(string name, Input<string> id, IdentitySourceState? state, CustomResourceOptions? opts = null)
    public static IdentitySource get(String name, Output<String> id, IdentitySourceState state, CustomResourceOptions options)
    resources:  _:    type: aws:verifiedpermissions:IdentitySource    get:      id: ${id}
    import {
  to = aws_verifiedpermissions_identity_source.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Configuration IdentitySourceConfiguration
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    PolicyStoreId string
    ID of the policy store in which you want to store this identity source.
    PrincipalEntityType string
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    Configuration IdentitySourceConfigurationArgs
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    PolicyStoreId string
    ID of the policy store in which you want to store this identity source.
    PrincipalEntityType string
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration object
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policy_store_id string
    ID of the policy store in which you want to store this identity source.
    principal_entity_type string
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration IdentitySourceConfiguration
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policyStoreId String
    ID of the policy store in which you want to store this identity source.
    principalEntityType String
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration IdentitySourceConfiguration
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policyStoreId string
    ID of the policy store in which you want to store this identity source.
    principalEntityType string
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration IdentitySourceConfigurationArgs
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policy_store_id str
    ID of the policy store in which you want to store this identity source.
    principal_entity_type str
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    configuration Property Map
    Details required to communicate with the identity provider (IdP) associated with this identity source. See Configuration below.
    policyStoreId String
    ID of the policy store in which you want to store this identity source.
    principalEntityType String
    Namespace and data type of the principals generated for identities authenticated by the new identity source.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.

    Supporting Types

    IdentitySourceConfiguration, IdentitySourceConfigurationArgs

    CognitoUserPoolConfiguration IdentitySourceConfigurationCognitoUserPoolConfiguration
    Configuration details of an Amazon Cognito user pool that Verified Permissions can use as a source of authenticated identities as entities. See Cognito User Pool Configuration below.
    OpenIdConnectConfiguration IdentitySourceConfigurationOpenIdConnectConfiguration
    Configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. See Open ID Connect Configuration below.
    CognitoUserPoolConfiguration IdentitySourceConfigurationCognitoUserPoolConfiguration
    Configuration details of an Amazon Cognito user pool that Verified Permissions can use as a source of authenticated identities as entities. See Cognito User Pool Configuration below.
    OpenIdConnectConfiguration IdentitySourceConfigurationOpenIdConnectConfiguration
    Configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. See Open ID Connect Configuration below.
    cognito_user_pool_configuration object
    Configuration details of an Amazon Cognito user pool that Verified Permissions can use as a source of authenticated identities as entities. See Cognito User Pool Configuration below.
    open_id_connect_configuration object
    Configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. See Open ID Connect Configuration below.
    cognitoUserPoolConfiguration IdentitySourceConfigurationCognitoUserPoolConfiguration
    Configuration details of an Amazon Cognito user pool that Verified Permissions can use as a source of authenticated identities as entities. See Cognito User Pool Configuration below.
    openIdConnectConfiguration IdentitySourceConfigurationOpenIdConnectConfiguration
    Configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. See Open ID Connect Configuration below.
    cognitoUserPoolConfiguration IdentitySourceConfigurationCognitoUserPoolConfiguration
    Configuration details of an Amazon Cognito user pool that Verified Permissions can use as a source of authenticated identities as entities. See Cognito User Pool Configuration below.
    openIdConnectConfiguration IdentitySourceConfigurationOpenIdConnectConfiguration
    Configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. See Open ID Connect Configuration below.
    cognito_user_pool_configuration IdentitySourceConfigurationCognitoUserPoolConfiguration
    Configuration details of an Amazon Cognito user pool that Verified Permissions can use as a source of authenticated identities as entities. See Cognito User Pool Configuration below.
    open_id_connect_configuration IdentitySourceConfigurationOpenIdConnectConfiguration
    Configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. See Open ID Connect Configuration below.
    cognitoUserPoolConfiguration Property Map
    Configuration details of an Amazon Cognito user pool that Verified Permissions can use as a source of authenticated identities as entities. See Cognito User Pool Configuration below.
    openIdConnectConfiguration Property Map
    Configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. See Open ID Connect Configuration below.

    IdentitySourceConfigurationCognitoUserPoolConfiguration, IdentitySourceConfigurationCognitoUserPoolConfigurationArgs

    UserPoolArn string
    ARN of the Amazon Cognito user pool that contains the identities to be authorized.
    ClientIds List<string>
    Unique application client IDs that are associated with the specified Amazon Cognito user pool.
    GroupConfiguration IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    UserPoolArn string
    ARN of the Amazon Cognito user pool that contains the identities to be authorized.
    ClientIds []string
    Unique application client IDs that are associated with the specified Amazon Cognito user pool.
    GroupConfiguration IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    user_pool_arn string
    ARN of the Amazon Cognito user pool that contains the identities to be authorized.
    client_ids list(string)
    Unique application client IDs that are associated with the specified Amazon Cognito user pool.
    group_configuration object
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    userPoolArn String
    ARN of the Amazon Cognito user pool that contains the identities to be authorized.
    clientIds List<String>
    Unique application client IDs that are associated with the specified Amazon Cognito user pool.
    groupConfiguration IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    userPoolArn string
    ARN of the Amazon Cognito user pool that contains the identities to be authorized.
    clientIds string[]
    Unique application client IDs that are associated with the specified Amazon Cognito user pool.
    groupConfiguration IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    user_pool_arn str
    ARN of the Amazon Cognito user pool that contains the identities to be authorized.
    client_ids Sequence[str]
    Unique application client IDs that are associated with the specified Amazon Cognito user pool.
    group_configuration IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    userPoolArn String
    ARN of the Amazon Cognito user pool that contains the identities to be authorized.
    clientIds List<String>
    Unique application client IDs that are associated with the specified Amazon Cognito user pool.
    groupConfiguration Property Map
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.

    IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfiguration, IdentitySourceConfigurationCognitoUserPoolConfigurationGroupConfigurationArgs

    GroupEntityType string
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    GroupEntityType string
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    group_entity_type string
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    groupEntityType String
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    groupEntityType string
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    group_entity_type str
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    groupEntityType String
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.

    IdentitySourceConfigurationOpenIdConnectConfiguration, IdentitySourceConfigurationOpenIdConnectConfigurationArgs

    Issuer string
    Issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path .well-known/openid-configuration.
    TokenSelection IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelection
    Token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source. See Token Selection below.
    EntityIdPrefix string
    Descriptive string that you want to prefix to user entities from your OIDC identity provider.
    GroupConfiguration IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    Issuer string
    Issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path .well-known/openid-configuration.
    TokenSelection IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelection
    Token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source. See Token Selection below.
    EntityIdPrefix string
    Descriptive string that you want to prefix to user entities from your OIDC identity provider.
    GroupConfiguration IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    issuer string
    Issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path .well-known/openid-configuration.
    token_selection object
    Token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source. See Token Selection below.
    entity_id_prefix string
    Descriptive string that you want to prefix to user entities from your OIDC identity provider.
    group_configuration object
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    issuer String
    Issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path .well-known/openid-configuration.
    tokenSelection IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelection
    Token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source. See Token Selection below.
    entityIdPrefix String
    Descriptive string that you want to prefix to user entities from your OIDC identity provider.
    groupConfiguration IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    issuer string
    Issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path .well-known/openid-configuration.
    tokenSelection IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelection
    Token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source. See Token Selection below.
    entityIdPrefix string
    Descriptive string that you want to prefix to user entities from your OIDC identity provider.
    groupConfiguration IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    issuer str
    Issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path .well-known/openid-configuration.
    token_selection IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelection
    Token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source. See Token Selection below.
    entity_id_prefix str
    Descriptive string that you want to prefix to user entities from your OIDC identity provider.
    group_configuration IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfiguration
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.
    issuer String
    Issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path .well-known/openid-configuration.
    tokenSelection Property Map
    Token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source. See Token Selection below.
    entityIdPrefix String
    Descriptive string that you want to prefix to user entities from your OIDC identity provider.
    groupConfiguration Property Map
    Type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source. See Group Configuration below.

    IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfiguration, IdentitySourceConfigurationOpenIdConnectConfigurationGroupConfigurationArgs

    GroupClaim string
    Token claim that you want Verified Permissions to interpret as group membership. For example, groups.
    GroupEntityType string
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    GroupClaim string
    Token claim that you want Verified Permissions to interpret as group membership. For example, groups.
    GroupEntityType string
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    group_claim string
    Token claim that you want Verified Permissions to interpret as group membership. For example, groups.
    group_entity_type string
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    groupClaim String
    Token claim that you want Verified Permissions to interpret as group membership. For example, groups.
    groupEntityType String
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    groupClaim string
    Token claim that you want Verified Permissions to interpret as group membership. For example, groups.
    groupEntityType string
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    group_claim str
    Token claim that you want Verified Permissions to interpret as group membership. For example, groups.
    group_entity_type str
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.
    groupClaim String
    Token claim that you want Verified Permissions to interpret as group membership. For example, groups.
    groupEntityType String
    Policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.

    IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelection, IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionArgs

    AccessTokenOnly IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnly
    OIDC configuration for processing access tokens. See Access Token Only below.
    IdentityTokenOnly IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnly
    OIDC configuration for processing identity (ID) tokens. See Identity Token Only below.
    AccessTokenOnly IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnly
    OIDC configuration for processing access tokens. See Access Token Only below.
    IdentityTokenOnly IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnly
    OIDC configuration for processing identity (ID) tokens. See Identity Token Only below.
    access_token_only object
    OIDC configuration for processing access tokens. See Access Token Only below.
    identity_token_only object
    OIDC configuration for processing identity (ID) tokens. See Identity Token Only below.
    accessTokenOnly IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnly
    OIDC configuration for processing access tokens. See Access Token Only below.
    identityTokenOnly IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnly
    OIDC configuration for processing identity (ID) tokens. See Identity Token Only below.
    accessTokenOnly IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnly
    OIDC configuration for processing access tokens. See Access Token Only below.
    identityTokenOnly IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnly
    OIDC configuration for processing identity (ID) tokens. See Identity Token Only below.
    access_token_only IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnly
    OIDC configuration for processing access tokens. See Access Token Only below.
    identity_token_only IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnly
    OIDC configuration for processing identity (ID) tokens. See Identity Token Only below.
    accessTokenOnly Property Map
    OIDC configuration for processing access tokens. See Access Token Only below.
    identityTokenOnly Property Map
    OIDC configuration for processing identity (ID) tokens. See Identity Token Only below.

    IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnly, IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionAccessTokenOnlyArgs

    Audiences List<string>
    Access token aud claim values that you want to accept in your policy store.
    PrincipalIdClaim string
    Claim that determines the principal in OIDC access tokens.
    Audiences []string
    Access token aud claim values that you want to accept in your policy store.
    PrincipalIdClaim string
    Claim that determines the principal in OIDC access tokens.
    audiences list(string)
    Access token aud claim values that you want to accept in your policy store.
    principal_id_claim string
    Claim that determines the principal in OIDC access tokens.
    audiences List<String>
    Access token aud claim values that you want to accept in your policy store.
    principalIdClaim String
    Claim that determines the principal in OIDC access tokens.
    audiences string[]
    Access token aud claim values that you want to accept in your policy store.
    principalIdClaim string
    Claim that determines the principal in OIDC access tokens.
    audiences Sequence[str]
    Access token aud claim values that you want to accept in your policy store.
    principal_id_claim str
    Claim that determines the principal in OIDC access tokens.
    audiences List<String>
    Access token aud claim values that you want to accept in your policy store.
    principalIdClaim String
    Claim that determines the principal in OIDC access tokens.

    IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnly, IdentitySourceConfigurationOpenIdConnectConfigurationTokenSelectionIdentityTokenOnlyArgs

    ClientIds List<string>
    ID token audience, or client ID, claim values that you want to accept in your policy store from an OIDC identity provider.
    PrincipalIdClaim string
    Claim that determines the principal in OIDC identity tokens.
    ClientIds []string
    ID token audience, or client ID, claim values that you want to accept in your policy store from an OIDC identity provider.
    PrincipalIdClaim string
    Claim that determines the principal in OIDC identity tokens.
    client_ids list(string)
    ID token audience, or client ID, claim values that you want to accept in your policy store from an OIDC identity provider.
    principal_id_claim string
    Claim that determines the principal in OIDC identity tokens.
    clientIds List<String>
    ID token audience, or client ID, claim values that you want to accept in your policy store from an OIDC identity provider.
    principalIdClaim String
    Claim that determines the principal in OIDC identity tokens.
    clientIds string[]
    ID token audience, or client ID, claim values that you want to accept in your policy store from an OIDC identity provider.
    principalIdClaim string
    Claim that determines the principal in OIDC identity tokens.
    client_ids Sequence[str]
    ID token audience, or client ID, claim values that you want to accept in your policy store from an OIDC identity provider.
    principal_id_claim str
    Claim that determines the principal in OIDC identity tokens.
    clientIds List<String>
    ID token audience, or client ID, claim values that you want to accept in your policy store from an OIDC identity provider.
    principalIdClaim String
    Claim that determines the principal in OIDC identity tokens.

    Import

    Using pulumi import, import Verified Permissions Identity Source using the policy_store_id:identity_source_id. For example:

    $ pulumi import aws:verifiedpermissions/identitySource:IdentitySource example policy-store-id-12345678:identity-source-id-12345678

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo aws logo
    Viewing docs for AWS v7.50.0
    published on Thursday, Oct 8, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial