@propulsionworks/cloudformation 0.0.1 → 0.1.0

package/out/exports/resources.generated/aws-transfer-webapp.d.ts

@@ -0,0 +1,115 @@
+import type { ResourceDefinitionWithAttributes, Tag } from "../main.ts";
+export type TransferWebApp = ResourceDefinitionWithAttributes<"AWS::Transfer::WebApp", TransferWebAppProps, TransferWebAppAttribs>;
+/**
+ * Creates a web app based on specified parameters, and returns the ID for the new web app.
+ */
+export type TransferWebAppProps = {
+    /**
+     * The `AccessEndpoint` is the URL that you provide to your users for them to interact with the Transfer Family web app. You can specify a custom URL or use the default value.
+     *
+     * Before you enter a custom URL for this parameter, follow the steps described in [Update your access endpoint with a custom URL](https://docs.aws.amazon.com//transfer/latest/userguide/webapp-customize.html) .
+     * @minLength 1
+     * @maxLength 1024
+     */
+    AccessEndpoint?: string | undefined;
+    /**
+     * You can provide a structure that contains the details for the identity provider to use with your web app.
+     *
+     * For more details about this parameter, see [Configure your identity provider for Transfer Family web apps](https://docs.aws.amazon.com//transfer/latest/userguide/webapp-identity-center.html) .
+     */
+    IdentityProviderDetails: IdentityProviderDetails;
+    /**
+     * Key-value pairs that can be used to group and search for web apps. Tags are metadata attached to web apps for any purpose.
+     */
+    Tags?: Tag[] | undefined;
+    /**
+     * A structure that contains the customization fields for the web app. You can provide a title, logo, and icon to customize the appearance of your web app.
+     */
+    WebAppCustomization?: WebAppCustomization | undefined;
+    /**
+     * Setting for the type of endpoint policy for the web app. The default value is `STANDARD` .
+     *
+     * If your web app was created in an AWS GovCloud (US) Region , the value of this parameter can be `FIPS` , which indicates the web app endpoint is FIPS-compliant.
+     */
+    WebAppEndpointPolicy?: WebAppEndpointPolicy | undefined;
+    /**
+     * A union that contains the value for number of concurrent connections or the user sessions on your web app.
+     */
+    WebAppUnits?: WebAppUnits | undefined;
+};
+export type TransferWebAppAttribs = {
+    /**
+     * The Amazon Resource Name (ARN) of the web app.
+     * @minLength 20
+     * @maxLength 1600
+     * @pattern arn:.*
+     */
+    Arn: string;
+    /**
+     * The Amazon Resource Name (ARN) for the IAM Identity Center application: this value is set automatically when you create your web app.
+     * @minLength 10
+     * @maxLength 1224
+     * @pattern ^arn:[\w-]+:sso::\d{12}:application/(sso)?ins-[a-zA-Z0-9-.]{16}/apl-[a-zA-Z0-9]{16}$
+     */
+    "IdentityProviderDetails.ApplicationArn": string;
+    /**
+     * The unique identifier for the web app.
+     * @minLength 24
+     * @maxLength 24
+     * @pattern ^webapp-([0-9a-f]{17})$
+     */
+    WebAppId: string;
+};
+/**
+ * A structure that describes the values to use for the IAM Identity Center settings when you create or update a web app.
+ */
+export type IdentityProviderDetails = {
+    /**
+     * The Amazon Resource Name (ARN) for the IAM Identity Center used for the web app.
+     * @minLength 10
+     * @maxLength 1224
+     * @pattern ^arn:[\w-]+:sso:::instance/(sso)?ins-[a-zA-Z0-9-.]{16}$
+     */
+    InstanceArn?: string | undefined;
+    /**
+     * The IAM role in IAM Identity Center used for the web app.
+     * @minLength 20
+     * @maxLength 2048
+     * @pattern ^arn:[a-z-]+:iam::[0-9]{12}:role[:/]\S+$
+     */
+    Role?: string | undefined;
+};
+/**
+ * A structure that contains the customization fields for the web app. You can provide a title, logo, and icon to customize the appearance of your web app.
+ */
+export type WebAppCustomization = {
+    /**
+     * Returns an icon file data string (in base64 encoding).
+     * @minLength 1
+     * @maxLength 20960
+     */
+    FaviconFile?: string | undefined;
+    /**
+     * Returns a logo file data string (in base64 encoding).
+     * @minLength 1
+     * @maxLength 51200
+     */
+    LogoFile?: string | undefined;
+    /**
+     * Returns the page title that you defined for your web app.
+     * @minLength 0
+     * @maxLength 100
+     */
+    Title?: string | undefined;
+};
+export type WebAppEndpointPolicy = "STANDARD" | "FIPS";
+/**
+ * Contains an integer value that represents the value for number of concurrent connections or the user sessions on your web app.
+ */
+export type WebAppUnits = {
+    /**
+     * @min 1
+     */
+    Provisioned: number;
+};
+//# sourceMappingURL=aws-transfer-webapp.d.ts.map

package/out/exports/resources.generated/aws-transfer-workflow.d.ts

@@ -0,0 +1,262 @@
+import type { ResourceDefinitionWithAttributes, Tag } from "../main.ts";
+export type TransferWorkflow = ResourceDefinitionWithAttributes<"AWS::Transfer::Workflow", TransferWorkflowProps, TransferWorkflowAttribs>;
+/**
+ * Allows you to create a workflow with specified steps and step details the workflow invokes after file transfer completes. After creating a workflow, you can associate the workflow created with any transfer servers by specifying the `workflow-details` field in `CreateServer` and `UpdateServer` operations.
+ */
+export type TransferWorkflowProps = {
+    /**
+     * Specifies the text description for the workflow.
+     * @minLength 0
+     * @maxLength 256
+     * @pattern ^[\w\- ]*$
+     */
+    Description?: string | undefined;
+    /**
+     * Specifies the steps (actions) to take if errors are encountered during execution of the workflow.
+     */
+    OnExceptionSteps?: WorkflowStep[] | undefined;
+    /**
+     * Specifies the details for the steps that are in the specified workflow.
+     */
+    Steps: WorkflowStep[];
+    /**
+     * Key-value pairs that can be used to group and search for workflows. Tags are metadata attached to workflows for any purpose.
+     */
+    Tags?: Tag[] | undefined;
+};
+export type TransferWorkflowAttribs = {
+    /**
+     * Specifies the unique Amazon Resource Name (ARN) for the workflow.
+     * @minLength 20
+     * @maxLength 1600
+     * @pattern arn:.*
+     */
+    Arn: string;
+    /**
+     * A unique identifier for a workflow.
+     * @minLength 19
+     * @maxLength 19
+     * @pattern ^w-([a-z0-9]{17})$
+     */
+    WorkflowId: string;
+};
+/**
+ * Specifies the Amazon EFS identifier and the path for the file being used.
+ */
+export type EfsInputFileLocation = {
+    /**
+     * The identifier of the file system, assigned by Amazon EFS.
+     * @minLength 0
+     * @maxLength 128
+     * @pattern ^(arn:aws[-a-z]*:elasticfilesystem:[0-9a-z-:]+:(access-point/fsap|file-system/fs)-[0-9a-f]{8,40}|fs(ap)?-[0-9a-f]{8,40})$
+     */
+    FileSystemId?: string | undefined;
+    /**
+     * The pathname for the folder being used by a workflow.
+     * @minLength 1
+     * @maxLength 65536
+     * @pattern ^[^\x00]+$
+     */
+    Path?: string | undefined;
+};
+/**
+ * Specifies the location for the file that's being processed.
+ */
+export type InputFileLocation = {
+    /**
+     * Specifies the details for the Amazon Elastic File System (Amazon EFS) file that's being decrypted.
+     */
+    EfsFileLocation?: EfsInputFileLocation | undefined;
+    /**
+     * Specifies the details for the Amazon S3 file that's being copied or decrypted.
+     */
+    S3FileLocation?: S3InputFileLocation | undefined;
+};
+/**
+ * Specifies the S3 details for the file being used, such as bucket, ETag, and so forth.
+ */
+export type S3FileLocation = {
+    /**
+     * Specifies the details for the file location for the file that's being used in the workflow. Only applicable if you are using Amazon S3 storage.
+     */
+    S3FileLocation?: S3InputFileLocation | undefined;
+};
+/**
+ * Specifies the details for the Amazon S3 location for an input file to a workflow.
+ */
+export type S3InputFileLocation = {
+    /**
+     * Specifies the S3 bucket for the customer input file.
+     * @minLength 3
+     * @maxLength 63
+     * @pattern ^[a-z0-9][\.\-a-z0-9]{1,61}[a-z0-9]$
+     */
+    Bucket?: string | undefined;
+    /**
+     * The name assigned to the file when it was created in Amazon S3. You use the object key to retrieve the object.
+     * @minLength 0
+     * @maxLength 1024
+     * @pattern .*
+     */
+    Key?: string | undefined;
+};
+/**
+ * The basic building block of a workflow.
+ */
+export type WorkflowStep = {
+    /**
+     * Details for a step that performs a file copy.
+     *
+     * Consists of the following values:
+     *
+     * - A description
+     * - An Amazon S3 location for the destination of the file copy.
+     * - A flag that indicates whether to overwrite an existing file of the same name. The default is `FALSE` .
+     */
+    CopyStepDetails?: {
+        DestinationFileLocation?: S3FileLocation | undefined;
+        /**
+         * The name of the step, used as an identifier.
+         * @minLength 0
+         * @maxLength 30
+         * @pattern ^[\w-]*$
+         */
+        Name?: string | undefined;
+        /**
+         * A flag that indicates whether or not to overwrite an existing file of the same name. The default is FALSE.
+         */
+        OverwriteExisting?: "TRUE" | "FALSE" | undefined;
+        /**
+         * Specifies which file to use as input to the workflow step.
+         * @minLength 0
+         * @maxLength 256
+         * @pattern ^\$\{(\w+.)+\w+\}$
+         */
+        SourceFileLocation?: string | undefined;
+    } | undefined;
+    /**
+     * Details for a step that invokes an AWS Lambda function.
+     *
+     * Consists of the Lambda function's name, target, and timeout (in seconds).
+     */
+    CustomStepDetails?: {
+        /**
+         * The name of the step, used as an identifier.
+         * @minLength 0
+         * @maxLength 30
+         * @pattern ^[\w-]*$
+         */
+        Name?: string | undefined;
+        /**
+         * Specifies which file to use as input to the workflow step.
+         * @minLength 0
+         * @maxLength 256
+         * @pattern ^\$\{(\w+.)+\w+\}$
+         */
+        SourceFileLocation?: string | undefined;
+        /**
+         * The ARN for the lambda function that is being called.
+         * @minLength 0
+         * @maxLength 170
+         * @pattern arn:[a-z-]+:lambda:.*$
+         */
+        Target?: string | undefined;
+        /**
+         * Timeout, in seconds, for the step.
+         * @min 1
+         * @max 1800
+         */
+        TimeoutSeconds?: number | undefined;
+    } | undefined;
+    /**
+     * Details for a step that decrypts an encrypted file.
+     *
+     * Consists of the following values:
+     *
+     * - A descriptive name
+     * - An Amazon S3 or Amazon Elastic File System (Amazon EFS) location for the source file to decrypt.
+     * - An S3 or Amazon EFS location for the destination of the file decryption.
+     * - A flag that indicates whether to overwrite an existing file of the same name. The default is `FALSE` .
+     * - The type of encryption that's used. Currently, only PGP encryption is supported.
+     */
+    DecryptStepDetails?: {
+        DestinationFileLocation: InputFileLocation;
+        /**
+         * The name of the step, used as an identifier.
+         * @minLength 0
+         * @maxLength 30
+         * @pattern ^[\w-]*$
+         */
+        Name?: string | undefined;
+        /**
+         * A flag that indicates whether or not to overwrite an existing file of the same name. The default is FALSE.
+         */
+        OverwriteExisting?: "TRUE" | "FALSE" | undefined;
+        /**
+         * Specifies which file to use as input to the workflow step.
+         * @minLength 0
+         * @maxLength 256
+         * @pattern ^\$\{(\w+.)+\w+\}$
+         */
+        SourceFileLocation?: string | undefined;
+        /**
+         * Specifies which encryption method to use.
+         */
+        Type: "PGP";
+    } | undefined;
+    /**
+     * Details for a step that deletes the file.
+     */
+    DeleteStepDetails?: {
+        /**
+         * The name of the step, used as an identifier.
+         * @minLength 0
+         * @maxLength 30
+         * @pattern ^[\w-]*$
+         */
+        Name?: string | undefined;
+        /**
+         * Specifies which file to use as input to the workflow step.
+         * @minLength 0
+         * @maxLength 256
+         * @pattern ^\$\{(\w+.)+\w+\}$
+         */
+        SourceFileLocation?: string | undefined;
+    } | undefined;
+    /**
+     * Details for a step that creates one or more tags.
+     *
+     * You specify one or more tags. Each tag contains a key-value pair.
+     */
+    TagStepDetails?: {
+        /**
+         * The name of the step, used as an identifier.
+         * @minLength 0
+         * @maxLength 30
+         * @pattern ^[\w-]*$
+         */
+        Name?: string | undefined;
+        /**
+         * Specifies which file to use as input to the workflow step.
+         * @minLength 0
+         * @maxLength 256
+         * @pattern ^\$\{(\w+.)+\w+\}$
+         */
+        SourceFileLocation?: string | undefined;
+        /**
+         * Array that contains from 1 to 10 key/value pairs.
+         */
+        Tags?: Tag[] | undefined;
+    } | undefined;
+    /**
+     * Currently, the following step types are supported.
+     *
+     * - *`COPY`* - Copy the file to another location.
+     * - *`CUSTOM`* - Perform a custom step with an AWS Lambda function target.
+     * - *`DECRYPT`* - Decrypt a file that was encrypted before it was uploaded.
+     * - *`DELETE`* - Delete the file.
+     * - *`TAG`* - Add a tag to the file.
+     */
+    Type?: "COPY" | "CUSTOM" | "DECRYPT" | "DELETE" | "TAG" | undefined;
+};
+//# sourceMappingURL=aws-transfer-workflow.d.ts.map

package/out/exports/resources.generated/aws-verifiedpermissions-identitysource.d.ts

@@ -0,0 +1,184 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type VerifiedPermissionsIdentitySource = ResourceDefinitionWithAttributes<"AWS::VerifiedPermissions::IdentitySource", VerifiedPermissionsIdentitySourceProps, VerifiedPermissionsIdentitySourceAttribs>;
+/**
+ * Creates or updates a reference to Amazon Cognito as an external identity provider.
+ *
+ * If you are creating a new identity source, then you must specify a `Configuration` . If you are updating an existing identity source, then you must specify an `UpdateConfiguration` .
+ *
+ * After you create an identity source, you can use the identities provided by the IdP as proxies for the principal in authorization queries that use the [IsAuthorizedWithToken](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html) operation. These identities take the form of tokens that contain claims about the user, such as IDs, attributes and group memberships. Amazon Cognito provides both identity tokens and access tokens, and Verified Permissions can use either or both. Any combination of identity and access tokens results in the same Cedar principal. Verified Permissions automatically translates the information about the identities into the standard Cedar attributes that can be evaluated by your policies. Because the Amazon Cognito identity and access tokens can contain different information, the tokens you choose to use determine the attributes that are available to access in the Cedar principal from your policies.
+ *
+ * Amazon Cognito Identity is not available in all of the same AWS Regions as Amazon Verified Permissions . Because of this, the `AWS::VerifiedPermissions::IdentitySource` type is not available to create from AWS CloudFormation in Regions where Amazon Cognito Identity is not currently available. Users can still create `AWS::VerifiedPermissions::IdentitySource` in those Regions, but only from the AWS CLI , Amazon Verified Permissions SDK, or from the AWS console.
+ *
+ * > To reference a user from this identity source in your Cedar policies, use the following syntax.
+ * >
+ * > *IdentityType::"<CognitoUserPoolIdentifier>|<CognitoClientId>*
+ * >
+ * > Where `IdentityType` is the string that you provide to the `PrincipalEntityType` parameter for this operation. The `CognitoUserPoolId` and `CognitoClientId` are defined by the Amazon Cognito user pool.
+ */
+export type VerifiedPermissionsIdentitySourceProps = {
+    /**
+     * Contains configuration information used when creating a new identity source.
+     */
+    Configuration: IdentitySourceConfiguration;
+    /**
+     * Specifies the ID of the policy store in which you want to store this identity source. Only policies and requests made using this policy store can reference identities from the identity provider configured in the new identity source.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     */
+    PolicyStoreId: string;
+    /**
+     * Specifies the namespace and data type of the principals generated for identities authenticated by the new identity source.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^.*$
+     */
+    PrincipalEntityType?: string | undefined;
+};
+export type VerifiedPermissionsIdentitySourceAttribs = {
+    /**
+     * The unique ID of the new or updated identity store.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     */
+    IdentitySourceId: string;
+};
+/**
+ * The type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source.
+ */
+export type CognitoGroupConfiguration = {
+    /**
+     * The name of the schema entity type that's mapped to the user pool group. Defaults to `AWS::CognitoGroup` .
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^([_a-zA-Z][_a-zA-Z0-9]*::)*[_a-zA-Z][_a-zA-Z0-9]*$
+     */
+    GroupEntityType: string;
+};
+/**
+ * A structure that contains configuration information used when creating or updating an identity source that represents a connection to an Amazon Cognito user pool used as an identity provider for Verified Permissions .
+ */
+export type CognitoUserPoolConfiguration = {
+    /**
+     * The unique application client IDs that are associated with the specified Amazon Cognito user pool.
+     *
+     * Example: `"ClientIds": ["&ExampleCogClientId;"]`
+     */
+    ClientIds?: string[] | undefined;
+    /**
+     * The type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source.
+     */
+    GroupConfiguration?: CognitoGroupConfiguration | undefined;
+    /**
+     * The [Amazon Resource Name (ARN)](https://docs.aws.amazon.com//general/latest/gr/aws-arns-and-namespaces.html) of the Amazon Cognito user pool that contains the identities to be authorized.
+     * @minLength 1
+     * @maxLength 255
+     * @pattern ^arn:[a-zA-Z0-9-]+:cognito-idp:(([a-zA-Z0-9-]+:\d{12}:userpool/[\w-]+_[0-9a-zA-Z]+))$
+     */
+    UserPoolArn: string;
+};
+/**
+ * A structure that contains configuration information used when creating or updating a new identity source.
+ *
+ * > At this time, the only valid member of this structure is a Amazon Cognito user pool configuration.
+ * >
+ * > You must specify a `userPoolArn` , and optionally, a `ClientId` .
+ */
+export type IdentitySourceConfiguration = {
+    CognitoUserPoolConfiguration: CognitoUserPoolConfiguration;
+} | {
+    OpenIdConnectConfiguration: OpenIdConnectConfiguration;
+};
+/**
+ * The configuration of an OpenID Connect (OIDC) identity source for handling access token claims. Contains the claim that you want to identify as the principal in an authorization request, and the values of the `aud` claim, or audiences, that you want to accept.
+ *
+ * This data type is part of a [OpenIdConnectTokenSelection](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectTokenSelection.html) structure, which is a parameter of [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ */
+export type OpenIdConnectAccessTokenConfiguration = {
+    /**
+     * The access token `aud` claim values that you want to accept in your policy store. For example, `https://myapp.example.com, https://myapp2.example.com` .
+     */
+    Audiences?: string[] | undefined;
+    /**
+     * The claim that determines the principal in OIDC access tokens. For example, `sub` .
+     * @minLength 1
+     * @default "sub"
+     */
+    PrincipalIdClaim?: string | undefined;
+};
+/**
+ * Contains configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. It specifies the issuer URL, token type that you want to use, and policy store entity details.
+ *
+ * This data type is part of a [Configuration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_Configuration.html) structure, which is a parameter to [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ */
+export type OpenIdConnectConfiguration = {
+    /**
+     * A descriptive string that you want to prefix to user entities from your OIDC identity provider. For example, if you set an `entityIdPrefix` of `MyOIDCProvider` , you can reference principals in your policies in the format `MyCorp::User::MyOIDCProvider|Carlos` .
+     * @minLength 1
+     * @maxLength 100
+     */
+    EntityIdPrefix?: string | undefined;
+    /**
+     * The claim in OIDC identity provider tokens that indicates a user's group membership, and the entity type that you want to map it to. For example, this object can map the contents of a `groups` claim to `MyCorp::UserGroup` .
+     */
+    GroupConfiguration?: OpenIdConnectGroupConfiguration | undefined;
+    /**
+     * The issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path `.well-known/openid-configuration` .
+     * @minLength 1
+     * @maxLength 2048
+     * @pattern ^https://.*$
+     */
+    Issuer: string;
+    /**
+     * The token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source.
+     */
+    TokenSelection: OpenIdConnectTokenSelection;
+};
+/**
+ * The claim in OIDC identity provider tokens that indicates a user's group membership, and the entity type that you want to map it to. For example, this object can map the contents of a `groups` claim to `MyCorp::UserGroup` .
+ *
+ * This data type is part of a [OpenIdConnectConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfiguration.html) structure, which is a parameter of [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ */
+export type OpenIdConnectGroupConfiguration = {
+    /**
+     * The token claim that you want Verified Permissions to interpret as group membership. For example, `groups` .
+     * @minLength 1
+     */
+    GroupClaim: string;
+    /**
+     * The policy store entity type that you want to map your users' group claim to. For example, `MyCorp::UserGroup` . A group entity type is an entity that can have a user entity type as a member.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^([_a-zA-Z][_a-zA-Z0-9]*::)*[_a-zA-Z][_a-zA-Z0-9]*$
+     */
+    GroupEntityType: string;
+};
+/**
+ * The configuration of an OpenID Connect (OIDC) identity source for handling identity (ID) token claims. Contains the claim that you want to identify as the principal in an authorization request, and the values of the `aud` claim, or audiences, that you want to accept.
+ *
+ * This data type is part of a [OpenIdConnectTokenSelection](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectTokenSelection.html) structure, which is a parameter of [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ */
+export type OpenIdConnectIdentityTokenConfiguration = {
+    /**
+     * The ID token audience, or client ID, claim values that you want to accept in your policy store from an OIDC identity provider. For example, `1example23456789, 2example10111213` .
+     */
+    ClientIds?: string[] | undefined;
+    /**
+     * The claim that determines the principal in OIDC access tokens. For example, `sub` .
+     * @minLength 1
+     * @default "sub"
+     */
+    PrincipalIdClaim?: string | undefined;
+};
+/**
+ * The token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source.
+ *
+ * This data type is part of a [OpenIdConnectConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfiguration.html) structure, which is a parameter of [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ */
+export type OpenIdConnectTokenSelection = {
+    AccessTokenOnly: OpenIdConnectAccessTokenConfiguration;
+} | {
+    IdentityTokenOnly: OpenIdConnectIdentityTokenConfiguration;
+};
+//# sourceMappingURL=aws-verifiedpermissions-identitysource.d.ts.map

package/out/exports/resources.generated/aws-verifiedpermissions-policy.d.ts

@@ -0,0 +1,127 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type VerifiedPermissionsPolicy = ResourceDefinitionWithAttributes<"AWS::VerifiedPermissions::Policy", VerifiedPermissionsPolicyProps, VerifiedPermissionsPolicyAttribs>;
+/**
+ * Creates or updates a Cedar policy and saves it in the specified policy store. You can create either a static policy or a policy linked to a policy template.
+ *
+ * You can directly update only static policies. To update a template-linked policy, you must update its linked policy template instead.
+ *
+ * - To create a static policy, in the `Definition` include a `Static` element that includes the Cedar policy text in the `Statement` element.
+ * - To create a policy that is dynamically linked to a policy template, in the `Definition` include a `Templatelinked` element that specifies the policy template ID and the principal and resource to associate with this policy. If the policy template is ever updated, any policies linked to the policy template automatically use the updated template.
+ *
+ * > - If policy validation is enabled in the policy store, then updating a static policy causes Verified Permissions to validate the policy against the schema in the policy store. If the updated static policy doesn't pass validation, the operation fails and the update isn't stored.
+ * > - When you edit a static policy, You can change only certain elements of a static policy:
+ * >
+ * > - The action referenced by the policy.
+ * > - A condition clause, such as when and unless.
+ * >
+ * > You can't change these elements of a static policy:
+ * >
+ * > - Changing a policy from a static policy to a template-linked policy.
+ * > - Changing the effect of a static policy from permit or forbid.
+ * > - The principal referenced by a static policy.
+ * > - The resource referenced by a static policy.
+ * > - To update a template-linked policy, you must update the template instead.
+ */
+export type VerifiedPermissionsPolicyProps = {
+    /**
+     * Specifies the policy type and content to use for the new or updated policy. The definition structure must include either a `Static` or a `TemplateLinked` element.
+     */
+    Definition: PolicyDefinition;
+    /**
+     * Specifies the `PolicyStoreId` of the policy store you want to store the policy in.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     */
+    PolicyStoreId: string;
+};
+export type VerifiedPermissionsPolicyAttribs = {
+    /**
+     * The unique ID of the new or updated policy.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     */
+    PolicyId: string;
+    /**
+     * The type of the policy. This is one of the following values:
+     *
+     * - Static
+     * - TemplateLinked
+     */
+    PolicyType: PolicyType;
+};
+/**
+ * Contains the identifier of an entity in a policy, including its ID and type.
+ */
+export type EntityIdentifier = {
+    /**
+     * The identifier of an entity.
+     *
+     * `"entityId":" *identifier* "`
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^.*$
+     */
+    EntityId: string;
+    /**
+     * The type of an entity.
+     *
+     * Example: `"entityType":" *typeName* "`
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^.*$
+     */
+    EntityType: string;
+};
+/**
+ * A structure that defines a Cedar policy. It includes the policy type, a description, and a policy body. This is a top level data type used to create a policy.
+ *
+ * This data type is used as a request parameter for the [CreatePolicy](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicy.html) operation. This structure must always have either an `Static` or a `TemplateLinked` element.
+ */
+export type PolicyDefinition = {
+    Static: StaticPolicyDefinition;
+} | {
+    TemplateLinked: TemplateLinkedPolicyDefinition;
+};
+export type PolicyType = "STATIC" | "TEMPLATE_LINKED";
+/**
+ * A structure that defines a static policy.
+ */
+export type StaticPolicyDefinition = {
+    /**
+     * The description of the static policy.
+     * @minLength 0
+     * @maxLength 150
+     */
+    Description?: string | undefined;
+    /**
+     * The policy content of the static policy, written in the Cedar policy language.
+     * @minLength 1
+     * @maxLength 10000
+     */
+    Statement: string;
+};
+/**
+ * A structure that describes a policy created by instantiating a policy template.
+ *
+ * > You can't directly update a template-linked policy. You must update the associated policy template instead.
+ */
+export type TemplateLinkedPolicyDefinition = {
+    /**
+     * The unique identifier of the policy template used to create this policy.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     */
+    PolicyTemplateId: string;
+    /**
+     * The principal associated with this template-linked policy. Verified Permissions substitutes this principal for the `?principal` placeholder in the policy template when it evaluates an authorization request.
+     */
+    Principal?: EntityIdentifier | undefined;
+    /**
+     * The resource associated with this template-linked policy. Verified Permissions substitutes this resource for the `?resource` placeholder in the policy template when it evaluates an authorization request.
+     */
+    Resource?: EntityIdentifier | undefined;
+};
+//# sourceMappingURL=aws-verifiedpermissions-policy.d.ts.map