1. Docs
  2. Reference
  3. API
  4. AWS
  5. cognito
  6. IdentityPoolRoleAttachment

IdentityPoolRoleAttachment

Provides an AWS Cognito Identity Pool Roles Attachment.

Example Usage

using Pulumi;
using Aws = Pulumi.Aws;

class MyStack : Stack
{
    public MyStack()
    {
        var mainIdentityPool = new Aws.Cognito.IdentityPool("mainIdentityPool", new Aws.Cognito.IdentityPoolArgs
        {
            AllowUnauthenticatedIdentities = false,
            IdentityPoolName = "identity pool",
            SupportedLoginProviders = 
            {
                { "graph.facebook.com", "7346241598935555" },
            },
        });
        var authenticatedRole = new Aws.Iam.Role("authenticatedRole", new Aws.Iam.RoleArgs
        {
            AssumeRolePolicy = mainIdentityPool.Id.Apply(id => @$"{{
  ""Version"": ""2012-10-17"",
  ""Statement"": [
    {{
      ""Effect"": ""Allow"",
      ""Principal"": {{
        ""Federated"": ""cognito-identity.amazonaws.com""
      }},
      ""Action"": ""sts:AssumeRoleWithWebIdentity"",
      ""Condition"": {{
        ""StringEquals"": {{
          ""cognito-identity.amazonaws.com:aud"": ""{id}""
        }},
        ""ForAnyValue:StringLike"": {{
          ""cognito-identity.amazonaws.com:amr"": ""authenticated""
        }}
      }}
    }}
  ]
}}

"),
        });
        var authenticatedRolePolicy = new Aws.Iam.RolePolicy("authenticatedRolePolicy", new Aws.Iam.RolePolicyArgs
        {
            Policy = @"{
  ""Version"": ""2012-10-17"",
  ""Statement"": [
    {
      ""Effect"": ""Allow"",
      ""Action"": [
        ""mobileanalytics:PutEvents"",
        ""cognito-sync:*"",
        ""cognito-identity:*""
      ],
      ""Resource"": [
        ""*""
      ]
    }
  ]
}

",
            Role = authenticatedRole.Id,
        });
        var mainIdentityPoolRoleAttachment = new Aws.Cognito.IdentityPoolRoleAttachment("mainIdentityPoolRoleAttachment", new Aws.Cognito.IdentityPoolRoleAttachmentArgs
        {
            IdentityPoolId = mainIdentityPool.Id,
            RoleMappings = 
            {
                new Aws.Cognito.Inputs.IdentityPoolRoleAttachmentRoleMappingArgs
                {
                    AmbiguousRoleResolution = "AuthenticatedRole",
                    IdentityProvider = "graph.facebook.com",
                    MappingRules = 
                    {
                        new Aws.Cognito.Inputs.IdentityPoolRoleAttachmentRoleMappingMappingRuleArgs
                        {
                            Claim = "isAdmin",
                            MatchType = "Equals",
                            RoleArn = authenticatedRole.Arn,
                            Value = "paid",
                        },
                    },
                    Type = "Rules",
                },
            },
            Roles = 
            {
                { "authenticated", authenticatedRole.Arn },
            },
        });
    }

}

package main

import (
    "fmt"

    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/cognito"
    "github.com/pulumi/pulumi-aws/sdk/v2/go/aws/iam"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        mainIdentityPool, err := cognito.NewIdentityPool(ctx, "mainIdentityPool", &cognito.IdentityPoolArgs{
            AllowUnauthenticatedIdentities: pulumi.Bool(false),
            IdentityPoolName:               pulumi.String("identity pool"),
            SupportedLoginProviders: pulumi.StringMap{
                "graph.facebook.com": pulumi.String("7346241598935555"),
            },
        })
        if err != nil {
            return err
        }
        authenticatedRole, err := iam.NewRole(ctx, "authenticatedRole", &iam.RoleArgs{
            AssumeRolePolicy: mainIdentityPool.ID().ApplyT(func(id string) (string, error) {
                return fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v", "{\n", "  \"Version\": \"2012-10-17\",\n", "  \"Statement\": [\n", "    {\n", "      \"Effect\": \"Allow\",\n", "      \"Principal\": {\n", "        \"Federated\": \"cognito-identity.amazonaws.com\"\n", "      },\n", "      \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n", "      \"Condition\": {\n", "        \"StringEquals\": {\n", "          \"cognito-identity.amazonaws.com:aud\": \"", id, "\"\n", "        },\n", "        \"ForAnyValue:StringLike\": {\n", "          \"cognito-identity.amazonaws.com:amr\": \"authenticated\"\n", "        }\n", "      }\n", "    }\n", "  ]\n", "}\n", "\n"), nil
            }).(pulumi.StringOutput),
        })
        if err != nil {
            return err
        }
        _, err = iam.NewRolePolicy(ctx, "authenticatedRolePolicy", &iam.RolePolicyArgs{
            Policy: pulumi.String(fmt.Sprintf("%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v%v", "{\n", "  \"Version\": \"2012-10-17\",\n", "  \"Statement\": [\n", "    {\n", "      \"Effect\": \"Allow\",\n", "      \"Action\": [\n", "        \"mobileanalytics:PutEvents\",\n", "        \"cognito-sync:*\",\n", "        \"cognito-identity:*\"\n", "      ],\n", "      \"Resource\": [\n", "        \"*\"\n", "      ]\n", "    }\n", "  ]\n", "}\n", "\n")),
            Role:   authenticatedRole.ID(),
        })
        if err != nil {
            return err
        }
        _, err = cognito.NewIdentityPoolRoleAttachment(ctx, "mainIdentityPoolRoleAttachment", &cognito.IdentityPoolRoleAttachmentArgs{
            IdentityPoolId: mainIdentityPool.ID(),
            RoleMappings: cognito.IdentityPoolRoleAttachmentRoleMappingArray{
                &cognito.IdentityPoolRoleAttachmentRoleMappingArgs{
                    AmbiguousRoleResolution: pulumi.String("AuthenticatedRole"),
                    IdentityProvider:        pulumi.String("graph.facebook.com"),
                    MappingRules: cognito.IdentityPoolRoleAttachmentRoleMappingMappingRuleArray{
                        &cognito.IdentityPoolRoleAttachmentRoleMappingMappingRuleArgs{
                            Claim:     pulumi.String("isAdmin"),
                            MatchType: pulumi.String("Equals"),
                            RoleArn:   authenticatedRole.Arn,
                            Value:     pulumi.String("paid"),
                        },
                    },
                    Type: pulumi.String("Rules"),
                },
            },
            Roles: pulumi.StringMap{
                "authenticated": authenticatedRole.Arn,
            },
        })
        if err != nil {
            return err
        }
        return nil
    })
}
import pulumi
import pulumi_aws as aws

main_identity_pool = aws.cognito.IdentityPool("mainIdentityPool",
    allow_unauthenticated_identities=False,
    identity_pool_name="identity pool",
    supported_login_providers={
        "graph.facebook.com": "7346241598935555",
    })
authenticated_role = aws.iam.Role("authenticatedRole", assume_role_policy=main_identity_pool.id.apply(lambda id: f"""{{
  "Version": "2012-10-17",
  "Statement": [
    {{
      "Effect": "Allow",
      "Principal": {{
        "Federated": "cognito-identity.amazonaws.com"
      }},
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {{
        "StringEquals": {{
          "cognito-identity.amazonaws.com:aud": "{id}"
        }},
        "ForAnyValue:StringLike": {{
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }}
      }}
    }}
  ]
}}

"""))
authenticated_role_policy = aws.iam.RolePolicy("authenticatedRolePolicy",
    policy="""{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mobileanalytics:PutEvents",
        "cognito-sync:*",
        "cognito-identity:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

""",
    role=authenticated_role.id)
main_identity_pool_role_attachment = aws.cognito.IdentityPoolRoleAttachment("mainIdentityPoolRoleAttachment",
    identity_pool_id=main_identity_pool.id,
    role_mappings=[{
        "ambiguousRoleResolution": "AuthenticatedRole",
        "identity_provider": "graph.facebook.com",
        "mappingRules": [{
            "claim": "isAdmin",
            "matchType": "Equals",
            "role_arn": authenticated_role.arn,
            "value": "paid",
        }],
        "type": "Rules",
    }],
    roles={
        "authenticated": authenticated_role.arn,
    })
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const mainIdentityPool = new aws.cognito.IdentityPool("main", {
    allowUnauthenticatedIdentities: false,
    identityPoolName: "identity pool",
    supportedLoginProviders: {
        "graph.facebook.com": "7346241598935555",
    },
});
const authenticatedRole = new aws.iam.Role("authenticated", {
    assumeRolePolicy: pulumi.interpolate`{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "${mainIdentityPool.id}"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}
`,
});
const authenticatedRolePolicy = new aws.iam.RolePolicy("authenticated", {
    policy: `{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mobileanalytics:PutEvents",
        "cognito-sync:*",
        "cognito-identity:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}
`,
    role: authenticatedRole.id,
});
const mainIdentityPoolRoleAttachment = new aws.cognito.IdentityPoolRoleAttachment("main", {
    identityPoolId: mainIdentityPool.id,
    roleMappings: [{
        ambiguousRoleResolution: "AuthenticatedRole",
        identityProvider: "graph.facebook.com",
        mappingRules: [{
            claim: "isAdmin",
            matchType: "Equals",
            roleArn: authenticatedRole.arn,
            value: "paid",
        }],
        type: "Rules",
    }],
    roles: {
        authenticated: authenticatedRole.arn,
    },
});

Create a IdentityPoolRoleAttachment Resource

new IdentityPoolRoleAttachment(name: string, args: IdentityPoolRoleAttachmentArgs, opts?: CustomResourceOptions);
def IdentityPoolRoleAttachment(resource_name, opts=None, identity_pool_id=None, role_mappings=None, roles=None, __props__=None);
func NewIdentityPoolRoleAttachment(ctx *Context, name string, args IdentityPoolRoleAttachmentArgs, opts ...ResourceOption) (*IdentityPoolRoleAttachment, error)
public IdentityPoolRoleAttachment(string name, IdentityPoolRoleAttachmentArgs args, CustomResourceOptions? opts = null)
name string
The unique name of the resource.
args IdentityPoolRoleAttachmentArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
opts ResourceOptions
A bag of options that control this resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args IdentityPoolRoleAttachmentArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args IdentityPoolRoleAttachmentArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.

IdentityPoolRoleAttachment Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The IdentityPoolRoleAttachment resource accepts the following input properties:

IdentityPoolId string

An identity pool ID in the format REGION:GUID.

Roles Dictionary<string, string>

The map of roles associated with this pool. For a given role, the key will be either “authenticated” or “unauthenticated” and the value will be the Role ARN.

RoleMappings List<IdentityPoolRoleAttachmentRoleMappingArgs>

A List of Role Mapping.

IdentityPoolId string

An identity pool ID in the format REGION:GUID.

Roles map[string]string

The map of roles associated with this pool. For a given role, the key will be either “authenticated” or “unauthenticated” and the value will be the Role ARN.

RoleMappings []IdentityPoolRoleAttachmentRoleMapping

A List of Role Mapping.

identityPoolId string

An identity pool ID in the format REGION:GUID.

roles {[key: string]: string}

The map of roles associated with this pool. For a given role, the key will be either “authenticated” or “unauthenticated” and the value will be the Role ARN.

roleMappings IdentityPoolRoleAttachmentRoleMapping[]

A List of Role Mapping.

identity_pool_id str

An identity pool ID in the format REGION:GUID.

roles Dict[str, str]

The map of roles associated with this pool. For a given role, the key will be either “authenticated” or “unauthenticated” and the value will be the Role ARN.

role_mappings List[IdentityPoolRoleAttachmentRoleMapping]

A List of Role Mapping.

Outputs

All input properties are implicitly available as output properties. Additionally, the IdentityPoolRoleAttachment resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.

Look up an Existing IdentityPoolRoleAttachment Resource

Get an existing IdentityPoolRoleAttachment resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: IdentityPoolRoleAttachmentState, opts?: CustomResourceOptions): IdentityPoolRoleAttachment
static get(resource_name, id, opts=None, identity_pool_id=None, role_mappings=None, roles=None, __props__=None);
func GetIdentityPoolRoleAttachment(ctx *Context, name string, id IDInput, state *IdentityPoolRoleAttachmentState, opts ...ResourceOption) (*IdentityPoolRoleAttachment, error)
public static IdentityPoolRoleAttachment Get(string name, Input<string> id, IdentityPoolRoleAttachmentState? state, CustomResourceOptions? opts = null)
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.

The following state arguments are supported:

IdentityPoolId string

An identity pool ID in the format REGION:GUID.

RoleMappings List<IdentityPoolRoleAttachmentRoleMappingArgs>

A List of Role Mapping.

Roles Dictionary<string, string>

The map of roles associated with this pool. For a given role, the key will be either “authenticated” or “unauthenticated” and the value will be the Role ARN.

IdentityPoolId string

An identity pool ID in the format REGION:GUID.

RoleMappings []IdentityPoolRoleAttachmentRoleMapping

A List of Role Mapping.

Roles map[string]string

The map of roles associated with this pool. For a given role, the key will be either “authenticated” or “unauthenticated” and the value will be the Role ARN.

identityPoolId string

An identity pool ID in the format REGION:GUID.

roleMappings IdentityPoolRoleAttachmentRoleMapping[]

A List of Role Mapping.

roles {[key: string]: string}

The map of roles associated with this pool. For a given role, the key will be either “authenticated” or “unauthenticated” and the value will be the Role ARN.

identity_pool_id str

An identity pool ID in the format REGION:GUID.

role_mappings List[IdentityPoolRoleAttachmentRoleMapping]

A List of Role Mapping.

roles Dict[str, str]

The map of roles associated with this pool. For a given role, the key will be either “authenticated” or “unauthenticated” and the value will be the Role ARN.

Supporting Types

IdentityPoolRoleAttachmentRoleMapping

See the input and output API doc for this type.

See the input and output API doc for this type.

See the input and output API doc for this type.

IdentityProvider string

A string identifying the identity provider, for example, “graph.facebook.com” or “cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id”.

Type string

The role mapping type.

AmbiguousRoleResolution string

Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. Required if you specify Token or Rules as the Type.

MappingRules List<IdentityPoolRoleAttachmentRoleMappingMappingRuleArgs>

The Rules Configuration to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.

IdentityProvider string

A string identifying the identity provider, for example, “graph.facebook.com” or “cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id”.

Type string

The role mapping type.

AmbiguousRoleResolution string

Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. Required if you specify Token or Rules as the Type.

MappingRules []IdentityPoolRoleAttachmentRoleMappingMappingRule

The Rules Configuration to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.

identityProvider string

A string identifying the identity provider, for example, “graph.facebook.com” or “cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id”.

type string

The role mapping type.

ambiguousRoleResolution string

Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. Required if you specify Token or Rules as the Type.

mappingRules IdentityPoolRoleAttachmentRoleMappingMappingRule[]

The Rules Configuration to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.

identity_provider str

A string identifying the identity provider, for example, “graph.facebook.com” or “cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id”.

type str

The role mapping type.

ambiguousRoleResolution str

Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. Required if you specify Token or Rules as the Type.

mappingRules List[IdentityPoolRoleAttachmentRoleMappingMappingRule]

The Rules Configuration to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.

IdentityPoolRoleAttachmentRoleMappingMappingRule

See the input and output API doc for this type.

See the input and output API doc for this type.

See the input and output API doc for this type.

Claim string

The claim name that must be present in the token, for example, “isAdmin” or “paid”.

MatchType string

The match condition that specifies how closely the claim value in the IdP token must match Value.

RoleArn string

The role ARN.

Value string

A brief string that the claim must match, for example, “paid” or “yes”.

Claim string

The claim name that must be present in the token, for example, “isAdmin” or “paid”.

MatchType string

The match condition that specifies how closely the claim value in the IdP token must match Value.

RoleArn string

The role ARN.

Value string

A brief string that the claim must match, for example, “paid” or “yes”.

claim string

The claim name that must be present in the token, for example, “isAdmin” or “paid”.

matchType string

The match condition that specifies how closely the claim value in the IdP token must match Value.

roleArn string

The role ARN.

value string

A brief string that the claim must match, for example, “paid” or “yes”.

claim str

The claim name that must be present in the token, for example, “isAdmin” or “paid”.

matchType str

The match condition that specifies how closely the claim value in the IdP token must match Value.

role_arn str

The role ARN.

value str

A brief string that the claim must match, for example, “paid” or “yes”.

Package Details

Repository
https://github.com/pulumi/pulumi-aws
License
Apache-2.0
Notes
This Pulumi package is based on the aws Terraform Provider.