Package com.pulumi.aws.cognito

Class UserPoolClient

  • public class UserPoolClient
extends com.pulumi.resources.CustomResource
    Provides a Cognito User Pool Client resource. To manage a User Pool Client created by another service, such as when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html), use the `aws.cognito.ManagedUserPoolClient` resource instead. ## Example Usage ### Create a basic user pool client 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cognito.UserPool;
 import com.pulumi.aws.cognito.UserPoolArgs;
 import com.pulumi.aws.cognito.UserPoolClient;
 import com.pulumi.aws.cognito.UserPoolClientArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var pool = new UserPool("pool", UserPoolArgs.builder()
             .name("pool")
             .build());
 
         var client = new UserPoolClient("client", UserPoolClientArgs.builder()
             .name("client")
             .userPoolId(pool.id())
             .build());
 
     }
 }
    ### Create a user pool client with no SRP authentication 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cognito.UserPool;
 import com.pulumi.aws.cognito.UserPoolArgs;
 import com.pulumi.aws.cognito.UserPoolClient;
 import com.pulumi.aws.cognito.UserPoolClientArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var pool = new UserPool("pool", UserPoolArgs.builder()
             .name("pool")
             .build());
 
         var client = new UserPoolClient("client", UserPoolClientArgs.builder()
             .name("client")
             .userPoolId(pool.id())
             .generateSecret(true)
             .explicitAuthFlows("ADMIN_NO_SRP_AUTH")
             .build());
 
     }
 }
    ### Create a user pool client with pinpoint analytics 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cognito.UserPool;
 import com.pulumi.aws.cognito.UserPoolArgs;
 import com.pulumi.aws.pinpoint.App;
 import com.pulumi.aws.pinpoint.AppArgs;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.cognito.UserPoolClient;
 import com.pulumi.aws.cognito.UserPoolClientArgs;
 import com.pulumi.aws.cognito.inputs.UserPoolClientAnalyticsConfigurationArgs;
 import com.pulumi.aws.AwsFunctions;
 import com.pulumi.aws.inputs.GetCallerIdentityArgs;
 import com.pulumi.aws.iam.RolePolicy;
 import com.pulumi.aws.iam.RolePolicyArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var testUserPool = new UserPool("testUserPool", UserPoolArgs.builder()
             .name("pool")
             .build());
 
         var testApp = new App("testApp", AppArgs.builder()
             .name("pinpoint")
             .build());
 
         final var assumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("Service")
                     .identifiers("cognito-idp.amazonaws.com")
                     .build())
                 .effect("Allow")
                 .actions("sts:AssumeRole")
                 .build())
             .build());
 
         var testRole = new Role("testRole", RoleArgs.builder()
             .name("role")
             .assumeRolePolicy(assumeRole.json())
             .build());
 
         var testUserPoolClient = new UserPoolClient("testUserPoolClient", UserPoolClientArgs.builder()
             .analyticsConfiguration(UserPoolClientAnalyticsConfigurationArgs.builder()
                 .applicationId(testApp.applicationId())
                 .externalId("some_id")
                 .roleArn(testRole.arn())
                 .userDataShared(true)
                 .build())
             .name("pool_client")
             .userPoolId(testUserPool.id())
             .build());
 
         final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
             .build());
 
         final var test = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .effect("Allow")
                 .actions(                
                     "mobiletargeting:UpdateEndpoint",
                     "mobiletargeting:PutEvents")
                 .resources(testApp.applicationId().applyValue(_applicationId -> String.format("arn:aws:mobiletargeting:*:%s:apps/%s*", current.accountId(),_applicationId)))
                 .build())
             .build());
 
         var testRolePolicy = new RolePolicy("testRolePolicy", RolePolicyArgs.builder()
             .name("role_policy")
             .role(testRole.id())
             .policy(test.applyValue(_test -> _test.json()))
             .build());
 
     }
 }
    ### Create a user pool client with Cognito as the identity provider 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cognito.UserPool;
 import com.pulumi.aws.cognito.UserPoolArgs;
 import com.pulumi.aws.cognito.UserPoolClient;
 import com.pulumi.aws.cognito.UserPoolClientArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var pool = new UserPool("pool", UserPoolArgs.builder()
             .name("pool")
             .build());
 
         var userpoolClient = new UserPoolClient("userpoolClient", UserPoolClientArgs.builder()
             .name("client")
             .userPoolId(pool.id())
             .callbackUrls("https://example.com")
             .allowedOauthFlowsUserPoolClient(true)
             .allowedOauthFlows(            
                 "code",
                 "implicit")
             .allowedOauthScopes(            
                 "email",
                 "openid")
             .supportedIdentityProviders("COGNITO")
             .build());
 
     }
 }
    ### Create a user pool client with refresh token rotation 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cognito.UserPool;
 import com.pulumi.aws.cognito.UserPoolArgs;
 import com.pulumi.aws.cognito.UserPoolClient;
 import com.pulumi.aws.cognito.UserPoolClientArgs;
 import com.pulumi.aws.cognito.inputs.UserPoolClientRefreshTokenRotationArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var pool = new UserPool("pool", UserPoolArgs.builder()
             .name("pool")
             .build());
 
         var userpoolClient = new UserPoolClient("userpoolClient", UserPoolClientArgs.builder()
             .refreshTokenRotation(UserPoolClientRefreshTokenRotationArgs.builder()
                 .feature("ENABLED")
                 .retryGracePeriodSeconds(10)
                 .build())
             .name("client")
             .userPoolId(pool.id())
             .explicitAuthFlows("ADMIN_NO_SRP_AUTH")
             .build());
 
     }
 }
    ## Import Using `pulumi import`, import Cognito User Pool Clients using the `id` of the Cognito User Pool, and the `id` of the Cognito User Pool Client. For example: ```sh $ pulumi import aws:cognito/userPoolClient:UserPoolClient client us-west-2_abc123/3ho4ek12345678909nh3fmhpko ```

    • Constructor Detail

      • UserPoolClient

        public UserPoolClient​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • UserPoolClient

        public UserPoolClient​(java.lang.String name,
                      UserPoolClientArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • UserPoolClient

        public UserPoolClient​(java.lang.String name,
                      UserPoolClientArgs args,
                      @Nullable
                      com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • accessTokenValidity

        public com.pulumi.core.Output<java.lang.Integer> accessTokenValidity()
        Returns:
        Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.access_token`.

      • allowedOauthFlows

        public com.pulumi.core.Output<java.util.List<java.lang.String>> allowedOauthFlows()
        Returns:
        List of allowed OAuth flows, including `code`, `implicit`, and `clientCredentials`. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure this option.

      • allowedOauthFlowsUserPoolClient

        public com.pulumi.core.Output<java.lang.Boolean> allowedOauthFlowsUserPoolClient()
        Returns:
        Whether the client is allowed to use OAuth 2.0 features. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure the following arguments: `callbackUrls`, `logoutUrls`, `allowedOauthScopes` and `allowedOauthFlows`.

      • allowedOauthScopes

        public com.pulumi.core.Output<java.util.List<java.lang.String>> allowedOauthScopes()
        Returns:
        List of allowed OAuth scopes, including `phone`, `email`, `openid`, `profile`, and `aws.cognito.signin.user.admin`. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure this option.

      • analyticsConfiguration

        public com.pulumi.core.Output<java.util.Optional<UserPoolClientAnalyticsConfiguration>> analyticsConfiguration()
        Returns:
        Configuration block for AWS End User Messaging analytics that collects metrics for this user pool. See details below.

      • authSessionValidity

        public com.pulumi.core.Output<java.lang.Integer> authSessionValidity()
        Returns:
        Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for `authSessionValidity` are between `3` and `15`, with a default value of `3`.

      • callbackUrls

        public com.pulumi.core.Output<java.util.List<java.lang.String>> callbackUrls()
        Returns:
        List of allowed callback URLs for the identity providers. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure this option.

      • clientSecret

        public com.pulumi.core.Output<java.lang.String> clientSecret()
        Returns:
        Client secret of the user pool client.

      • defaultRedirectUri

        public com.pulumi.core.Output<java.lang.String> defaultRedirectUri()
        Returns:
        Default redirect URI and must be included in the list of callback URLs.

      • enablePropagateAdditionalUserContextData

        public com.pulumi.core.Output<java.lang.Boolean> enablePropagateAdditionalUserContextData()
        Returns:
        Enables the propagation of additional user context data.

      • enableTokenRevocation

        public com.pulumi.core.Output<java.lang.Boolean> enableTokenRevocation()
        Returns:
        Enables or disables token revocation.

      • explicitAuthFlows

        public com.pulumi.core.Output<java.util.List<java.lang.String>> explicitAuthFlows()
        Returns:
        List of authentication flows. The available options include `ADMIN_NO_SRP_AUTH`, `CUSTOM_AUTH_FLOW_ONLY`, `USER_PASSWORD_AUTH`, `ALLOW_ADMIN_USER_PASSWORD_AUTH`, `ALLOW_CUSTOM_AUTH`, `ALLOW_USER_PASSWORD_AUTH`, `ALLOW_USER_SRP_AUTH`, `ALLOW_REFRESH_TOKEN_AUTH`, and `ALLOW_USER_AUTH`.

      • generateSecret

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> generateSecret()
        Returns:
        Boolean flag indicating whether an application secret should be generated.

      • idTokenValidity

        public com.pulumi.core.Output<java.lang.Integer> idTokenValidity()
        Returns:
        Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.id_token`.

      • logoutUrls

        public com.pulumi.core.Output<java.util.List<java.lang.String>> logoutUrls()
        Returns:
        List of allowed logout URLs for the identity providers. `allowedOauthFlowsUserPoolClient` must be set to `true` before you can configure this option.

      • name

        public com.pulumi.core.Output<java.lang.String> name()
        Returns:
        Name of the application client.

      • preventUserExistenceErrors

        public com.pulumi.core.Output<java.lang.String> preventUserExistenceErrors()
        Returns:
        Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.

      • readAttributes

        public com.pulumi.core.Output<java.util.List<java.lang.String>> readAttributes()
        Returns:
        List of user pool attributes that the application client can read from.

      • refreshTokenRotation

        public com.pulumi.core.Output<java.util.Optional<UserPoolClientRefreshTokenRotation>> refreshTokenRotation()
        Returns:
        A block that specifies the configuration of refresh token rotation. Detailed below.

      • refreshTokenValidity

        public com.pulumi.core.Output<java.lang.Integer> refreshTokenValidity()
        Returns:
        Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in `token_validity_units.refresh_token`.

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • supportedIdentityProviders

        public com.pulumi.core.Output<java.util.List<java.lang.String>> supportedIdentityProviders()
        Returns:
        List of provider names for the identity providers that are supported on this client. It uses the `providerName` attribute of the `aws.cognito.IdentityProvider` resource(s), or the equivalent string(s).

      • tokenValidityUnits

        public com.pulumi.core.Output<java.util.Optional<UserPoolClientTokenValidityUnits>> tokenValidityUnits()
        Returns:
        Configuration block for representing the validity times in units. See details below. Detailed below.

      • userPoolId

        public com.pulumi.core.Output<java.lang.String> userPoolId()
        Returns:
        User pool the client belongs to. The following arguments are optional:

      • writeAttributes

        public com.pulumi.core.Output<java.util.List<java.lang.String>> writeAttributes()
        Returns:
        List of user pool attributes that the application client can write to.

      • get

        public static UserPoolClient get​(java.lang.String name,
                                 com.pulumi.core.Output<java.lang.String> id,
                                 @Nullable
                                 UserPoolClientState state,
                                 @Nullable
                                 com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.