@aws-sdk/client-verifiedpermissions 3.592.0 → 3.593.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/dist-cjs/index.js +239 -6
  2. package/dist-es/models/models_0.js +191 -3
  3. package/dist-types/commands/CreateIdentitySourceCommand.d.ts +47 -20
  4. package/dist-types/commands/GetIdentitySourceCommand.d.ts +20 -0
  5. package/dist-types/commands/IsAuthorizedWithTokenCommand.d.ts +2 -1
  6. package/dist-types/commands/ListIdentitySourcesCommand.d.ts +20 -0
  7. package/dist-types/commands/UpdateIdentitySourceCommand.d.ts +23 -1
  8. package/dist-types/models/models_0.d.ts +779 -25
  9. package/dist-types/ts3.4/models/models_0.d.ts +294 -0
  10. package/package.json +1 -1
package/dist-types/commands/CreateIdentitySourceCommand.d.ts CHANGED
@@ -27,31 +27,36 @@ declare const CreateIdentitySourceCommand_base: {
27
27
  getEndpointParameterInstructions(): import("@smithy/middleware-endpoint").EndpointParameterInstructions;
28
28
  };
29
29
  /**
30
- * <p>Creates a reference to an Amazon Cognito user pool as an external identity provider (IdP).
30
+ * <p>Adds an identity source to a policy store–an Amazon Cognito user pool or OpenID Connect
31
+ * (OIDC) identity provider (IdP).
31
32
  * </p>
32
33
  * <p>After you create an identity source, you can use the identities provided by the IdP as proxies
33
- * for the principal in authorization queries that use the <a href="https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html">IsAuthorizedWithToken</a>
34
- * operation. These identities take the form of tokens that contain claims about the user,
35
- * such as IDs, attributes and group memberships. Amazon Cognito provides both identity tokens and
36
- * access tokens, and Verified Permissions can use either or both. Any combination of identity and access
37
- * tokens results in the same Cedar principal. Verified Permissions automatically translates the
38
- * information about the identities into the standard Cedar attributes that can be
39
- * evaluated by your policies. Because the Amazon Cognito identity and access tokens can contain
40
- * different information, the tokens you choose to use determine which principal attributes
41
- * are available to access when evaluating Cedar policies.</p>
34
+ * for the principal in authorization queries that use the <a href="https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html">IsAuthorizedWithToken</a> or
35
+ * <a href="https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedWithToken.html">BatchIsAuthorizedWithToken</a> API operations. These identities take the form
36
+ * of tokens that contain claims about the user, such as IDs, attributes and group
37
+ * memberships. Identity sources provide identity (ID) tokens and access tokens. Verified Permissions
38
+ * derives information about your user and session from token claims. Access tokens provide
39
+ * action <code>context</code> to your policies, and ID tokens provide principal
40
+ * <code>Attributes</code>.</p>
42
41
  * <important>
43
- * <p>If you delete a Amazon Cognito user pool or user, tokens from that deleted pool or that deleted user continue to be usable until they expire.</p>
42
+ * <p>Tokens from an identity source user continue to be usable until they expire.
43
+ * Token revocation and resource deletion have no effect on the validity of a token in your policy store</p>
44
44
  * </important>
45
45
  * <note>
46
- * <p>To reference a user from this identity source in your Cedar policies, use the following
47
- * syntax.</p>
48
- * <p>
49
- * <i>IdentityType::"&lt;CognitoUserPoolIdentifier&gt;|&lt;CognitoClientId&gt;</i>
50
- * </p>
51
- * <p>Where <code>IdentityType</code> is the string that you provide to the
52
- * <code>PrincipalEntityType</code> parameter for this operation. The
53
- * <code>CognitoUserPoolId</code> and <code>CognitoClientId</code> are defined by
54
- * the Amazon Cognito user pool.</p>
46
+ * <p>To reference a user from this identity source in your Cedar policies, refer to the
47
+ * following syntax examples.</p>
48
+ * <ul>
49
+ * <li>
50
+ * <p>Amazon Cognito user pool: <code>Namespace::[Entity type]::[User pool ID]|[user
51
+ * principal attribute]</code>, for example
52
+ * <code>MyCorp::User::us-east-1_EXAMPLE|a1b2c3d4-5678-90ab-cdef-EXAMPLE11111</code>.</p>
53
+ * </li>
54
+ * <li>
55
+ * <p>OpenID Connect (OIDC) provider: <code>Namespace::[Entity
56
+ * type]::[principalIdClaim]|[user principal attribute]</code>, for example
57
+ * <code>MyCorp::User::MyOIDCProvider|a1b2c3d4-5678-90ab-cdef-EXAMPLE22222</code>.</p>
58
+ * </li>
59
+ * </ul>
55
60
  * </note>
56
61
  * <note>
57
62
  * <p>Verified Permissions is <i>
@@ -78,6 +83,28 @@ declare const CreateIdentitySourceCommand_base: {
78
83
  * groupEntityType: "STRING_VALUE", // required
79
84
  * },
80
85
  * },
86
+ * openIdConnectConfiguration: { // OpenIdConnectConfiguration
87
+ * issuer: "STRING_VALUE", // required
88
+ * entityIdPrefix: "STRING_VALUE",
89
+ * groupConfiguration: { // OpenIdConnectGroupConfiguration
90
+ * groupClaim: "STRING_VALUE", // required
91
+ * groupEntityType: "STRING_VALUE", // required
92
+ * },
93
+ * tokenSelection: { // OpenIdConnectTokenSelection Union: only one key present
94
+ * accessTokenOnly: { // OpenIdConnectAccessTokenConfiguration
95
+ * principalIdClaim: "STRING_VALUE",
96
+ * audiences: [ // Audiences
97
+ * "STRING_VALUE",
98
+ * ],
99
+ * },
100
+ * identityTokenOnly: { // OpenIdConnectIdentityTokenConfiguration
101
+ * principalIdClaim: "STRING_VALUE",
102
+ * clientIds: [
103
+ * "STRING_VALUE",
104
+ * ],
105
+ * },
106
+ * },
107
+ * },
81
108
  * },
82
109
  * principalEntityType: "STRING_VALUE",
83
110
  * };
package/dist-types/commands/GetIdentitySourceCommand.d.ts CHANGED
@@ -65,6 +65,26 @@ declare const GetIdentitySourceCommand_base: {
65
65
  * // groupEntityType: "STRING_VALUE",
66
66
  * // },
67
67
  * // },
68
+ * // openIdConnectConfiguration: { // OpenIdConnectConfigurationDetail
69
+ * // issuer: "STRING_VALUE", // required
70
+ * // entityIdPrefix: "STRING_VALUE",
71
+ * // groupConfiguration: { // OpenIdConnectGroupConfigurationDetail
72
+ * // groupClaim: "STRING_VALUE", // required
73
+ * // groupEntityType: "STRING_VALUE", // required
74
+ * // },
75
+ * // tokenSelection: { // OpenIdConnectTokenSelectionDetail Union: only one key present
76
+ * // accessTokenOnly: { // OpenIdConnectAccessTokenConfigurationDetail
77
+ * // principalIdClaim: "STRING_VALUE",
78
+ * // audiences: [ // Audiences
79
+ * // "STRING_VALUE",
80
+ * // ],
81
+ * // },
82
+ * // identityTokenOnly: { // OpenIdConnectIdentityTokenConfigurationDetail
83
+ * // principalIdClaim: "STRING_VALUE",
84
+ * // clientIds: "<ClientIds>",
85
+ * // },
86
+ * // },
87
+ * // },
68
88
  * // },
69
89
  * // };
70
90
  *
package/dist-types/commands/IsAuthorizedWithTokenCommand.d.ts CHANGED
@@ -39,7 +39,8 @@ declare const IsAuthorizedWithTokenCommand_base: {
39
39
  * <p>Verified Permissions validates each token that is specified in a request by checking its expiration
40
40
  * date and its signature.</p>
41
41
  * <important>
42
- * <p>If you delete a Amazon Cognito user pool or user, tokens from that deleted pool or that deleted user continue to be usable until they expire.</p>
42
+ * <p>Tokens from an identity source user continue to be usable until they expire.
43
+ * Token revocation and resource deletion have no effect on the validity of a token in your policy store</p>
43
44
  * </important>
44
45
  * @example
45
46
  * Use a bare-bones client and the command you need to make an API call.
package/dist-types/commands/ListIdentitySourcesCommand.d.ts CHANGED
@@ -74,6 +74,26 @@ declare const ListIdentitySourcesCommand_base: {
74
74
  * // groupEntityType: "STRING_VALUE",
75
75
  * // },
76
76
  * // },
77
+ * // openIdConnectConfiguration: { // OpenIdConnectConfigurationItem
78
+ * // issuer: "STRING_VALUE", // required
79
+ * // entityIdPrefix: "STRING_VALUE",
80
+ * // groupConfiguration: { // OpenIdConnectGroupConfigurationItem
81
+ * // groupClaim: "STRING_VALUE", // required
82
+ * // groupEntityType: "STRING_VALUE", // required
83
+ * // },
84
+ * // tokenSelection: { // OpenIdConnectTokenSelectionItem Union: only one key present
85
+ * // accessTokenOnly: { // OpenIdConnectAccessTokenConfigurationItem
86
+ * // principalIdClaim: "STRING_VALUE",
87
+ * // audiences: [ // Audiences
88
+ * // "STRING_VALUE",
89
+ * // ],
90
+ * // },
91
+ * // identityTokenOnly: { // OpenIdConnectIdentityTokenConfigurationItem
92
+ * // principalIdClaim: "STRING_VALUE",
93
+ * // clientIds: "<ClientIds>",
94
+ * // },
95
+ * // },
96
+ * // },
77
97
  * // },
78
98
  * // },
79
99
  * // ],
package/dist-types/commands/UpdateIdentitySourceCommand.d.ts CHANGED
@@ -27,7 +27,7 @@ declare const UpdateIdentitySourceCommand_base: {
27
27
  getEndpointParameterInstructions(): import("@smithy/middleware-endpoint").EndpointParameterInstructions;
28
28
  };
29
29
  /**
30
- * <p>Updates the specified identity source to use a new identity provider (IdP) source, or to change
30
+ * <p>Updates the specified identity source to use a new identity provider (IdP), or to change
31
31
  * the mapping of identities from the IdP to a different principal entity type.</p>
32
32
  * <note>
33
33
  * <p>Verified Permissions is <i>
@@ -54,6 +54,28 @@ declare const UpdateIdentitySourceCommand_base: {
54
54
  * groupEntityType: "STRING_VALUE", // required
55
55
  * },
56
56
  * },
57
+ * openIdConnectConfiguration: { // UpdateOpenIdConnectConfiguration
58
+ * issuer: "STRING_VALUE", // required
59
+ * entityIdPrefix: "STRING_VALUE",
60
+ * groupConfiguration: { // UpdateOpenIdConnectGroupConfiguration
61
+ * groupClaim: "STRING_VALUE", // required
62
+ * groupEntityType: "STRING_VALUE", // required
63
+ * },
64
+ * tokenSelection: { // UpdateOpenIdConnectTokenSelection Union: only one key present
65
+ * accessTokenOnly: { // UpdateOpenIdConnectAccessTokenConfiguration
66
+ * principalIdClaim: "STRING_VALUE",
67
+ * audiences: [ // Audiences
68
+ * "STRING_VALUE",
69
+ * ],
70
+ * },
71
+ * identityTokenOnly: { // UpdateOpenIdConnectIdentityTokenConfiguration
72
+ * principalIdClaim: "STRING_VALUE",
73
+ * clientIds: [
74
+ * "STRING_VALUE",
75
+ * ],
76
+ * },
77
+ * },
78
+ * },
57
79
  * },
58
80
  * principalEntityType: "STRING_VALUE",
59
81
  * };