user-pool-client resource¶
Source: internal/service/cognitoidp/user_pool_client_types.go:22
Example usage:
imports: {
aws-cognitoidp: 'github.com/cloudboss/unobin-library-aws//service/cognitoidp'
}
resources: {
example: aws-cognitoidp.user-pool-client {
# Set input fields here.
}
}
Inputs¶
user-pool-id
string
name
optional(string)
generate-secret
optional(boolean)
access-token-validity
optional(integer)
id-token-validity
optional(integer)
refresh-token-validity
optional(integer)
auth-session-validity
optional(integer)
token-validity-units
optional(object)
optional(
object({
access-token: optional(string)
id-token: optional(string)
refresh-token: optional(string)
})
)allowed-oauth-flows
optional(list(string))
allowed-oauth-scopes
optional(list(string))
callback-urls
optional(list(string))
logout-urls
optional(list(string))
explicit-auth-flows
optional(list(string))
read-attributes
optional(list(string))
write-attributes
optional(list(string))
supported-identity-providers
optional(list(string))
allowed-oauth-flows-user-pool-client
optional(boolean)
enable-propagate-additional-user-context-data
optional(boolean)
enable-token-revocation
optional(boolean)
default-redirect-uri
optional(string)
prevent-user-existence-errors
optional(string)
analytics-configuration
optional(object)
optional(
object({
application-arn: optional(string)
application-id: optional(string)
external-id: optional(string)
role-arn: optional(string)
user-data-shared: optional(boolean)
})
)refresh-token-rotation
optional(object)
optional(
object({
feature: string
retry-grace-period-seconds: optional(integer)
})
)Input Constraints¶
User pool id rules
user-pool-id must contain at least 1 character.
Rule logic
- Require
@core.length(input.user-pool-id) >= 1
user-pool-id must contain at most 55 characters.
Rule logic
- Require
@core.length(input.user-pool-id) <= 55
Name rules
name must contain at least 1 character.
Rule logic
- Require
input.name == null
|| @core.length(input.name) >= 1
name must contain at most 128 characters.
Rule logic
- Require
@core.length(input.name ?? '') <= 128
Access token validity rules
access-token-validity must be between 1 and 86400.
Rule logic
- When
input.access-token-validity != null- Require
input.access-token-validity >= 1
&& input.access-token-validity <= 86400
Id token validity rules
id-token-validity must be between 1 and 86400.
Rule logic
- When
input.id-token-validity != null- Require
input.id-token-validity >= 1
&& input.id-token-validity <= 86400
Refresh token validity rules
refresh-token-validity must be between 1 and 315360000.
Rule logic
- When
input.refresh-token-validity != null- Require
input.refresh-token-validity >= 1
&& input.refresh-token-validity <= 315360000
Auth session validity rules
auth-session-validity must be between 3 and 15.
Rule logic
- When
input.auth-session-validity != null- Require
input.auth-session-validity >= 3
&& input.auth-session-validity <= 15
Token validity units rules
access-token unit is invalid.
Rule logic
- When
input.token-validity-units.access-token != null- Require
input.token-validity-units.access-token == 'seconds'
|| input.token-validity-units.access-token == 'minutes'
|| input.token-validity-units.access-token == 'hours'
|| input.token-validity-units.access-token == 'days'
id-token unit is invalid.
Rule logic
- When
input.token-validity-units.id-token != null- Require
input.token-validity-units.id-token == 'seconds'
|| input.token-validity-units.id-token == 'minutes'
|| input.token-validity-units.id-token == 'hours'
|| input.token-validity-units.id-token == 'days'
refresh-token unit is invalid.
Rule logic
- When
input.token-validity-units.refresh-token != null- Require
input.token-validity-units.refresh-token == 'seconds'
|| input.token-validity-units.refresh-token == 'minutes'
|| input.token-validity-units.refresh-token == 'hours'
|| input.token-validity-units.refresh-token == 'days'
Allowed oauth flows rules
allowed-oauth-flows holds at most 3 entries.
Rule logic
- Require
@core.length(input.allowed-oauth-flows ?? []) <= 3
allowed-oauth-flows contains an invalid value.
Rule logic
- For each
input.allowed-oauth-flows ?? []- Require
@each.value == 'code'
|| @each.value == 'implicit'
|| @each.value == 'client_credentials'
OAuth settings require allowed-oauth-flows-user-pool-client true.
Rule logic
- When
@core.length(input.allowed-oauth-flows ?? []) >= 1
|| @core.length(input.allowed-oauth-scopes ?? []) >= 1
|| @core.length(input.callback-urls ?? []) >= 1
|| @core.length(input.logout-urls ?? []) >= 1
|| input.default-redirect-uri != null- Require
input.allowed-oauth-flows-user-pool-client == true
Allowed oauth scopes rules
allowed-oauth-scopes holds at most 50 entries.
Rule logic
- Require
@core.length(input.allowed-oauth-scopes ?? []) <= 50
allowed-oauth-scopes entries must contain 1 to 256 characters.
Rule logic
- For each
input.allowed-oauth-scopes ?? []- Require
@core.length(@each.value) >= 1
&& @core.length(@each.value) <= 256
Callback urls rules
callback-urls holds at most 100 entries.
Rule logic
- Require
@core.length(input.callback-urls ?? []) <= 100
callback-urls entries must contain 1 to 1024 characters.
Rule logic
- For each
input.callback-urls ?? []- Require
@core.length(@each.value) >= 1
&& @core.length(@each.value) <= 1024
Logout urls rules
logout-urls holds at most 100 entries.
Rule logic
- Require
@core.length(input.logout-urls ?? []) <= 100
logout-urls entries must contain 1 to 1024 characters.
Rule logic
- For each
input.logout-urls ?? []- Require
@core.length(@each.value) >= 1
&& @core.length(@each.value) <= 1024
Explicit auth flows rules
explicit-auth-flows contains an invalid value.
Rule logic
- For each
input.explicit-auth-flows ?? []- Require
@each.value == 'ADMIN_NO_SRP_AUTH'
|| @each.value == 'CUSTOM_AUTH_FLOW_ONLY'
|| @each.value == 'USER_PASSWORD_AUTH'
|| @each.value == 'ALLOW_ADMIN_USER_PASSWORD_AUTH'
|| @each.value == 'ALLOW_CUSTOM_AUTH'
|| @each.value == 'ALLOW_USER_PASSWORD_AUTH'
|| @each.value == 'ALLOW_USER_SRP_AUTH'
|| @each.value == 'ALLOW_REFRESH_TOKEN_AUTH'
|| @each.value == 'ALLOW_USER_AUTH'
Read attributes rules
read-attributes entries must contain 1 to 2048 characters.
Rule logic
- For each
input.read-attributes ?? []- Require
@core.length(@each.value) >= 1
&& @core.length(@each.value) <= 2048
Write attributes rules
write-attributes entries must contain 1 to 2048 characters.
Rule logic
- For each
input.write-attributes ?? []- Require
@core.length(@each.value) >= 1
&& @core.length(@each.value) <= 2048
Supported identity providers rules
supported-identity-providers entries must contain 1 to 32 characters.
Rule logic
- For each
input.supported-identity-providers ?? []- Require
@core.length(@each.value) >= 1
&& @core.length(@each.value) <= 32
Enable propagate additional user context data rules
propagated user context data requires generate-secret true.
Rule logic
- When
input.enable-propagate-additional-user-context-data == true- Require
input.generate-secret == true
Prevent user existence errors rules
prevent-user-existence-errors must be LEGACY or ENABLED.
Rule logic
- When
input.prevent-user-existence-errors != null- Require
input.prevent-user-existence-errors == 'LEGACY'
|| input.prevent-user-existence-errors == 'ENABLED'
Refresh token rotation rules
refresh-token-rotation feature must be ENABLED or DISABLED.
Rule logic
- When
input.refresh-token-rotation != null- Require
input.refresh-token-rotation.feature == 'ENABLED'
|| input.refresh-token-rotation.feature == 'DISABLED'
refresh-token-rotation grace must be between 0 and 60.
Rule logic
- When
input.refresh-token-rotation.retry-grace-period-seconds != null- Require
input.refresh-token-rotation.retry-grace-period-seconds >= 0
&& input.refresh-token-rotation.retry-grace-period-seconds <= 60
Analytics configuration rules
analytics-configuration requires an ARN or application triplet.
Rule logic
- When
input.analytics-configuration != null- Require
input.analytics-configuration.application-arn != null
|| ((input.analytics-configuration.application-id != null) && (input.analytics-configuration.external-id != null) && (input.analytics-configuration.role-arn != null))
analytics application-arn conflicts with the application triplet.
analytics application triplet fields must be set together.
analytics application-arn must contain 20 to 2048 characters.
Rule logic
- Require
(input.analytics-configuration.application-arn == null || @core.length(input.analytics-configuration.application-arn) >= 20)
&& @core.length(input.analytics-configuration.application-arn ?? '') <= 2048
analytics role-arn must contain 20 to 2048 characters.
Rule logic
- Require
(input.analytics-configuration.role-arn == null || @core.length(input.analytics-configuration.role-arn) >= 20)
&& @core.length(input.analytics-configuration.role-arn ?? '') <= 2048
analytics external-id must contain at most 131072 characters.
Rule logic
- Require
@core.length(input.analytics-configuration.external-id ?? '') <= 131072
Outputs¶
id
string
name
string
client-secret
optional(string)