Package com.pulumi.aws.cognito

Class ManagedUserPoolClient

  • public class ManagedUserPoolClient
extends com.pulumi.resources.CustomResource
    Use the `aws.cognito.UserPoolClient` resource to manage a Cognito User Pool Client. **This resource is advanced** and has special caveats to consider before use. Please read this document completely before using the resource. Use the `aws.cognito.ManagedUserPoolClient` resource to manage a Cognito User Pool Client that is automatically created by an AWS service. For instance, when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html), the OpenSearch service creates the User Pool Client during setup and removes it when it is no longer required. As a result, the `aws.cognito.ManagedUserPoolClient` resource does not create or delete this resource, but instead assumes management of it. Use the `aws.cognito.UserPoolClient` resource to manage Cognito User Pool Clients for normal use cases. ## Example Usage ### Using Name Pattern 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cognito.ManagedUserPoolClient;
 import com.pulumi.aws.cognito.ManagedUserPoolClientArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new ManagedUserPoolClient("example", ManagedUserPoolClientArgs.builder()
             .namePattern("^AmazonOpenSearchService-example-(\\w+)$")
             .userPoolId(exampleAwsCognitoUserPool.id())
             .build());
 
     }
 }
    ## Import Using `pulumi import`, import Cognito User Pool Clients using the `id` of the Cognito User Pool and the `id` of the Cognito User Pool Client. For example: ```sh $ pulumi import aws:cognito/managedUserPoolClient:ManagedUserPoolClient client us-west-2_abc123/3ho4ek12345678909nh3fmhpko ```

    • Constructor Detail

      • ManagedUserPoolClient

        public ManagedUserPoolClient​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • ManagedUserPoolClient

        public ManagedUserPoolClient​(java.lang.String name,
                             ManagedUserPoolClientArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • ManagedUserPoolClient

        public ManagedUserPoolClient​(java.lang.String name,
                             ManagedUserPoolClientArgs args,
                             @Nullable
                             com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • accessTokenValidity

        public com.pulumi.core.Output<java.lang.Integer> accessTokenValidity()
        Returns:
        Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.access_token`.

      • allowedOauthFlows

        public com.pulumi.core.Output<java.util.List<java.lang.String>> allowedOauthFlows()
        Returns:
        List of allowed OAuth flows, including `code`, `implicit`, and `clientCredentials`. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure this option.

      • allowedOauthFlowsUserPoolClient

        public com.pulumi.core.Output<java.lang.Boolean> allowedOauthFlowsUserPoolClient()
        Returns:
        Whether the client is allowed to use OAuth 2.0 features. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure the following arguments: `callbackUrls`, `logoutUrls`, `allowedOauthScopes` and `allowedOauthFlows`.

      • allowedOauthScopes

        public com.pulumi.core.Output<java.util.List<java.lang.String>> allowedOauthScopes()
        Returns:
        List of allowed OAuth scopes, including `phone`, `email`, `openid`, `profile`, and `aws.cognito.signin.user.admin`. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure this option.

      • analyticsConfiguration

        public com.pulumi.core.Output<java.util.Optional<ManagedUserPoolClientAnalyticsConfiguration>> analyticsConfiguration()
        Returns:
        Configuration block for AWS End User Messaging analytics that collects metrics for this user pool. See details below.

      • authSessionValidity

        public com.pulumi.core.Output<java.lang.Integer> authSessionValidity()
        Returns:
        Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for `authSessionValidity` are between `3` and `15`, with a default value of `3`.

      • callbackUrls

        public com.pulumi.core.Output<java.util.List<java.lang.String>> callbackUrls()
        Returns:
        List of allowed callback URLs for the identity providers. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure this option.

      • clientSecret

        public com.pulumi.core.Output<java.lang.String> clientSecret()
        Returns:
        Client secret of the user pool client.

      • defaultRedirectUri

        public com.pulumi.core.Output<java.lang.String> defaultRedirectUri()
        Returns:
        Default redirect URI and must be included in the list of callback URLs.

      • enablePropagateAdditionalUserContextData

        public com.pulumi.core.Output<java.lang.Boolean> enablePropagateAdditionalUserContextData()
        Returns:
        Enables the propagation of additional user context data.

      • enableTokenRevocation

        public com.pulumi.core.Output<java.lang.Boolean> enableTokenRevocation()
        Returns:
        Enables or disables token revocation.

      • explicitAuthFlows

        public com.pulumi.core.Output<java.util.List<java.lang.String>> explicitAuthFlows()
        Returns:
        List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.

      • idTokenValidity

        public com.pulumi.core.Output<java.lang.Integer> idTokenValidity()
        Returns:
        Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.id_token`.

      • logoutUrls

        public com.pulumi.core.Output<java.util.List<java.lang.String>> logoutUrls()
        Returns:
        List of allowed logout URLs for the identity providers. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure this option.

      • name

        public com.pulumi.core.Output<java.lang.String> name()
        Returns:
        Name of the user pool client.

      • namePattern

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> namePattern()
        Returns:
        Regular expression that matches the name of the existing User Pool Client to be managed. It must only match one User Pool Client.

      • namePrefix

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> namePrefix()
        Returns:
        String that matches the beginning of the name of the existing User Pool Client to be managed. It must match only one User Pool Client. The following arguments are optional:

      • preventUserExistenceErrors

        public com.pulumi.core.Output<java.lang.String> preventUserExistenceErrors()
        Returns:
        Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

      • readAttributes

        public com.pulumi.core.Output<java.util.List<java.lang.String>> readAttributes()
        Returns:
        List of user pool attributes that the application client can read from.

      • refreshTokenRotation

        public com.pulumi.core.Output<java.util.Optional<ManagedUserPoolClientRefreshTokenRotation>> refreshTokenRotation()
        Returns:
        A block that specifies the configuration of refresh token rotation. Detailed below.

      • refreshTokenValidity

        public com.pulumi.core.Output<java.lang.Integer> refreshTokenValidity()
        Returns:
        Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in `token_validity_units.refresh_token`.

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • supportedIdentityProviders

        public com.pulumi.core.Output<java.util.List<java.lang.String>> supportedIdentityProviders()
        Returns:
        List of provider names for the identity providers that are supported on this client. It uses the `providerName` attribute of the `aws.cognito.IdentityProvider` resource(s), or the equivalent string(s).

      • tokenValidityUnits

        public com.pulumi.core.Output<java.util.Optional<ManagedUserPoolClientTokenValidityUnits>> tokenValidityUnits()
        Returns:
        Configuration block for representing the validity times in units. See details below. Detailed below.

      • userPoolId

        public com.pulumi.core.Output<java.lang.String> userPoolId()
        Returns:
        User pool that the client belongs to.

      • writeAttributes

        public com.pulumi.core.Output<java.util.List<java.lang.String>> writeAttributes()
        Returns:
        List of user pool attributes that the application client can write to.

      • get

        public static ManagedUserPoolClient get​(java.lang.String name,
                                        com.pulumi.core.Output<java.lang.String> id,
                                        @Nullable
                                        ManagedUserPoolClientState state,
                                        @Nullable
                                        com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.