@propulsionworks/cloudformation 0.0.2 → 0.1.1

package/out/exports/resources.generated/aws-verifiedpermissions-identitysource.d.ts

@@ -0,0 +1,230 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+/**
+ * Creates or updates a reference to Amazon Cognito as an external identity provider.
+ *
+ * If you are creating a new identity source, then you must specify a `Configuration` . If you are updating an existing identity source, then you must specify an `UpdateConfiguration` .
+ *
+ * After you create an identity source, you can use the identities provided by the IdP as proxies for the principal in authorization queries that use the [IsAuthorizedWithToken](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html) operation. These identities take the form of tokens that contain claims about the user, such as IDs, attributes and group memberships. Amazon Cognito provides both identity tokens and access tokens, and Verified Permissions can use either or both. Any combination of identity and access tokens results in the same Cedar principal. Verified Permissions automatically translates the information about the identities into the standard Cedar attributes that can be evaluated by your policies. Because the Amazon Cognito identity and access tokens can contain different information, the tokens you choose to use determine the attributes that are available to access in the Cedar principal from your policies.
+ *
+ * Amazon Cognito Identity is not available in all of the same AWS Regions as Amazon Verified Permissions . Because of this, the `AWS::VerifiedPermissions::IdentitySource` type is not available to create from AWS CloudFormation in Regions where Amazon Cognito Identity is not currently available. Users can still create `AWS::VerifiedPermissions::IdentitySource` in those Regions, but only from the AWS CLI , Amazon Verified Permissions SDK, or from the AWS console.
+ *
+ * > To reference a user from this identity source in your Cedar policies, use the following syntax.
+ * >
+ * > *IdentityType::"<CognitoUserPoolIdentifier>|<CognitoClientId>*
+ * >
+ * > Where `IdentityType` is the string that you provide to the `PrincipalEntityType` parameter for this operation. The `CognitoUserPoolId` and `CognitoClientId` are defined by the Amazon Cognito user pool.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-identitysource.html}
+ */
+export type VerifiedPermissionsIdentitySource = ResourceDefinitionWithAttributes<"AWS::VerifiedPermissions::IdentitySource", VerifiedPermissionsIdentitySourceProps, VerifiedPermissionsIdentitySourceAttribs>;
+/**
+ * Creates or updates a reference to Amazon Cognito as an external identity provider.
+ *
+ * If you are creating a new identity source, then you must specify a `Configuration` . If you are updating an existing identity source, then you must specify an `UpdateConfiguration` .
+ *
+ * After you create an identity source, you can use the identities provided by the IdP as proxies for the principal in authorization queries that use the [IsAuthorizedWithToken](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html) operation. These identities take the form of tokens that contain claims about the user, such as IDs, attributes and group memberships. Amazon Cognito provides both identity tokens and access tokens, and Verified Permissions can use either or both. Any combination of identity and access tokens results in the same Cedar principal. Verified Permissions automatically translates the information about the identities into the standard Cedar attributes that can be evaluated by your policies. Because the Amazon Cognito identity and access tokens can contain different information, the tokens you choose to use determine the attributes that are available to access in the Cedar principal from your policies.
+ *
+ * Amazon Cognito Identity is not available in all of the same AWS Regions as Amazon Verified Permissions . Because of this, the `AWS::VerifiedPermissions::IdentitySource` type is not available to create from AWS CloudFormation in Regions where Amazon Cognito Identity is not currently available. Users can still create `AWS::VerifiedPermissions::IdentitySource` in those Regions, but only from the AWS CLI , Amazon Verified Permissions SDK, or from the AWS console.
+ *
+ * > To reference a user from this identity source in your Cedar policies, use the following syntax.
+ * >
+ * > *IdentityType::"<CognitoUserPoolIdentifier>|<CognitoClientId>*
+ * >
+ * > Where `IdentityType` is the string that you provide to the `PrincipalEntityType` parameter for this operation. The `CognitoUserPoolId` and `CognitoClientId` are defined by the Amazon Cognito user pool.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-identitysource.html}
+ */
+export type VerifiedPermissionsIdentitySourceProps = {
+    /**
+     * Contains configuration information used when creating a new identity source.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-identitysource.html#cfn-verifiedpermissions-identitysource-configuration}
+     */
+    Configuration: IdentitySourceConfiguration;
+    /**
+     * Specifies the ID of the policy store in which you want to store this identity source. Only policies and requests made using this policy store can reference identities from the identity provider configured in the new identity source.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-identitysource.html#cfn-verifiedpermissions-identitysource-policystoreid}
+     */
+    PolicyStoreId: string;
+    /**
+     * Specifies the namespace and data type of the principals generated for identities authenticated by the new identity source.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^.*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-identitysource.html#cfn-verifiedpermissions-identitysource-principalentitytype}
+     */
+    PrincipalEntityType?: string | undefined;
+};
+/**
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-identitysource.html#aws-resource-verifiedpermissions-identitysource-return-values}
+ */
+export type VerifiedPermissionsIdentitySourceAttribs = {
+    /**
+     * The unique ID of the new or updated identity store.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-identitysource.html#cfn-verifiedpermissions-identitysource-identitysourceid}
+     */
+    IdentitySourceId: string;
+};
+/**
+ * The type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-cognitogroupconfiguration.html}
+ */
+export type CognitoGroupConfiguration = {
+    /**
+     * The name of the schema entity type that's mapped to the user pool group. Defaults to `AWS::CognitoGroup` .
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^([_a-zA-Z][_a-zA-Z0-9]*::)*[_a-zA-Z][_a-zA-Z0-9]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-cognitogroupconfiguration.html#cfn-verifiedpermissions-identitysource-cognitogroupconfiguration-groupentitytype}
+     */
+    GroupEntityType: string;
+};
+/**
+ * A structure that contains configuration information used when creating or updating an identity source that represents a connection to an Amazon Cognito user pool used as an identity provider for Verified Permissions .
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-cognitouserpoolconfiguration.html}
+ */
+export type CognitoUserPoolConfiguration = {
+    /**
+     * The unique application client IDs that are associated with the specified Amazon Cognito user pool.
+     *
+     * Example: `"ClientIds": ["&ExampleCogClientId;"]`
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-cognitouserpoolconfiguration.html#cfn-verifiedpermissions-identitysource-cognitouserpoolconfiguration-clientids}
+     */
+    ClientIds?: string[] | undefined;
+    /**
+     * The type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-cognitouserpoolconfiguration.html#cfn-verifiedpermissions-identitysource-cognitouserpoolconfiguration-groupconfiguration}
+     */
+    GroupConfiguration?: CognitoGroupConfiguration | undefined;
+    /**
+     * The [Amazon Resource Name (ARN)](https://docs.aws.amazon.com//general/latest/gr/aws-arns-and-namespaces.html) of the Amazon Cognito user pool that contains the identities to be authorized.
+     * @minLength 1
+     * @maxLength 255
+     * @pattern ^arn:[a-zA-Z0-9-]+:cognito-idp:(([a-zA-Z0-9-]+:\d{12}:userpool/[\w-]+_[0-9a-zA-Z]+))$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-cognitouserpoolconfiguration.html#cfn-verifiedpermissions-identitysource-cognitouserpoolconfiguration-userpoolarn}
+     */
+    UserPoolArn: string;
+};
+/**
+ * A structure that contains configuration information used when creating or updating a new identity source.
+ *
+ * > At this time, the only valid member of this structure is a Amazon Cognito user pool configuration.
+ * >
+ * > You must specify a `userPoolArn` , and optionally, a `ClientId` .
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-identitysourceconfiguration.html}
+ */
+export type IdentitySourceConfiguration = {
+    CognitoUserPoolConfiguration: CognitoUserPoolConfiguration;
+} | {
+    OpenIdConnectConfiguration: OpenIdConnectConfiguration;
+};
+/**
+ * The configuration of an OpenID Connect (OIDC) identity source for handling access token claims. Contains the claim that you want to identify as the principal in an authorization request, and the values of the `aud` claim, or audiences, that you want to accept.
+ *
+ * This data type is part of a [OpenIdConnectTokenSelection](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectTokenSelection.html) structure, which is a parameter of [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectaccesstokenconfiguration.html}
+ */
+export type OpenIdConnectAccessTokenConfiguration = {
+    /**
+     * The access token `aud` claim values that you want to accept in your policy store. For example, `https://myapp.example.com, https://myapp2.example.com` .
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectaccesstokenconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectaccesstokenconfiguration-audiences}
+     */
+    Audiences?: string[] | undefined;
+    /**
+     * The claim that determines the principal in OIDC access tokens. For example, `sub` .
+     * @minLength 1
+     * @default "sub"
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectaccesstokenconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectaccesstokenconfiguration-principalidclaim}
+     */
+    PrincipalIdClaim?: string | undefined;
+};
+/**
+ * Contains configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. It specifies the issuer URL, token type that you want to use, and policy store entity details.
+ *
+ * This data type is part of a [Configuration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_Configuration.html) structure, which is a parameter to [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectconfiguration.html}
+ */
+export type OpenIdConnectConfiguration = {
+    /**
+     * A descriptive string that you want to prefix to user entities from your OIDC identity provider. For example, if you set an `entityIdPrefix` of `MyOIDCProvider` , you can reference principals in your policies in the format `MyCorp::User::MyOIDCProvider|Carlos` .
+     * @minLength 1
+     * @maxLength 100
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectconfiguration-entityidprefix}
+     */
+    EntityIdPrefix?: string | undefined;
+    /**
+     * The claim in OIDC identity provider tokens that indicates a user's group membership, and the entity type that you want to map it to. For example, this object can map the contents of a `groups` claim to `MyCorp::UserGroup` .
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectconfiguration-groupconfiguration}
+     */
+    GroupConfiguration?: OpenIdConnectGroupConfiguration | undefined;
+    /**
+     * The issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path `.well-known/openid-configuration` .
+     * @minLength 1
+     * @maxLength 2048
+     * @pattern ^https://.*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectconfiguration-issuer}
+     */
+    Issuer: string;
+    /**
+     * The token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectconfiguration-tokenselection}
+     */
+    TokenSelection: OpenIdConnectTokenSelection;
+};
+/**
+ * The claim in OIDC identity provider tokens that indicates a user's group membership, and the entity type that you want to map it to. For example, this object can map the contents of a `groups` claim to `MyCorp::UserGroup` .
+ *
+ * This data type is part of a [OpenIdConnectConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfiguration.html) structure, which is a parameter of [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectgroupconfiguration.html}
+ */
+export type OpenIdConnectGroupConfiguration = {
+    /**
+     * The token claim that you want Verified Permissions to interpret as group membership. For example, `groups` .
+     * @minLength 1
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectgroupconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectgroupconfiguration-groupclaim}
+     */
+    GroupClaim: string;
+    /**
+     * The policy store entity type that you want to map your users' group claim to. For example, `MyCorp::UserGroup` . A group entity type is an entity that can have a user entity type as a member.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^([_a-zA-Z][_a-zA-Z0-9]*::)*[_a-zA-Z][_a-zA-Z0-9]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectgroupconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectgroupconfiguration-groupentitytype}
+     */
+    GroupEntityType: string;
+};
+/**
+ * The configuration of an OpenID Connect (OIDC) identity source for handling identity (ID) token claims. Contains the claim that you want to identify as the principal in an authorization request, and the values of the `aud` claim, or audiences, that you want to accept.
+ *
+ * This data type is part of a [OpenIdConnectTokenSelection](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectTokenSelection.html) structure, which is a parameter of [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectidentitytokenconfiguration.html}
+ */
+export type OpenIdConnectIdentityTokenConfiguration = {
+    /**
+     * The ID token audience, or client ID, claim values that you want to accept in your policy store from an OIDC identity provider. For example, `1example23456789, 2example10111213` .
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectidentitytokenconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectidentitytokenconfiguration-clientids}
+     */
+    ClientIds?: string[] | undefined;
+    /**
+     * The claim that determines the principal in OIDC access tokens. For example, `sub` .
+     * @minLength 1
+     * @default "sub"
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnectidentitytokenconfiguration.html#cfn-verifiedpermissions-identitysource-openidconnectidentitytokenconfiguration-principalidclaim}
+     */
+    PrincipalIdClaim?: string | undefined;
+};
+/**
+ * The token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source.
+ *
+ * This data type is part of a [OpenIdConnectConfiguration](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_OpenIdConnectConfiguration.html) structure, which is a parameter of [CreateIdentitySource](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) .
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-identitysource-openidconnecttokenselection.html}
+ */
+export type OpenIdConnectTokenSelection = {
+    AccessTokenOnly: OpenIdConnectAccessTokenConfiguration;
+} | {
+    IdentityTokenOnly: OpenIdConnectIdentityTokenConfiguration;
+};
+//# sourceMappingURL=aws-verifiedpermissions-identitysource.d.ts.map

package/out/exports/resources.generated/aws-verifiedpermissions-policy.d.ts

@@ -0,0 +1,172 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+/**
+ * Creates or updates a Cedar policy and saves it in the specified policy store. You can create either a static policy or a policy linked to a policy template.
+ *
+ * You can directly update only static policies. To update a template-linked policy, you must update its linked policy template instead.
+ *
+ * - To create a static policy, in the `Definition` include a `Static` element that includes the Cedar policy text in the `Statement` element.
+ * - To create a policy that is dynamically linked to a policy template, in the `Definition` include a `Templatelinked` element that specifies the policy template ID and the principal and resource to associate with this policy. If the policy template is ever updated, any policies linked to the policy template automatically use the updated template.
+ *
+ * > - If policy validation is enabled in the policy store, then updating a static policy causes Verified Permissions to validate the policy against the schema in the policy store. If the updated static policy doesn't pass validation, the operation fails and the update isn't stored.
+ * > - When you edit a static policy, You can change only certain elements of a static policy:
+ * >
+ * > - The action referenced by the policy.
+ * > - A condition clause, such as when and unless.
+ * >
+ * > You can't change these elements of a static policy:
+ * >
+ * > - Changing a policy from a static policy to a template-linked policy.
+ * > - Changing the effect of a static policy from permit or forbid.
+ * > - The principal referenced by a static policy.
+ * > - The resource referenced by a static policy.
+ * > - To update a template-linked policy, you must update the template instead.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policy.html}
+ */
+export type VerifiedPermissionsPolicy = ResourceDefinitionWithAttributes<"AWS::VerifiedPermissions::Policy", VerifiedPermissionsPolicyProps, VerifiedPermissionsPolicyAttribs>;
+/**
+ * Creates or updates a Cedar policy and saves it in the specified policy store. You can create either a static policy or a policy linked to a policy template.
+ *
+ * You can directly update only static policies. To update a template-linked policy, you must update its linked policy template instead.
+ *
+ * - To create a static policy, in the `Definition` include a `Static` element that includes the Cedar policy text in the `Statement` element.
+ * - To create a policy that is dynamically linked to a policy template, in the `Definition` include a `Templatelinked` element that specifies the policy template ID and the principal and resource to associate with this policy. If the policy template is ever updated, any policies linked to the policy template automatically use the updated template.
+ *
+ * > - If policy validation is enabled in the policy store, then updating a static policy causes Verified Permissions to validate the policy against the schema in the policy store. If the updated static policy doesn't pass validation, the operation fails and the update isn't stored.
+ * > - When you edit a static policy, You can change only certain elements of a static policy:
+ * >
+ * > - The action referenced by the policy.
+ * > - A condition clause, such as when and unless.
+ * >
+ * > You can't change these elements of a static policy:
+ * >
+ * > - Changing a policy from a static policy to a template-linked policy.
+ * > - Changing the effect of a static policy from permit or forbid.
+ * > - The principal referenced by a static policy.
+ * > - The resource referenced by a static policy.
+ * > - To update a template-linked policy, you must update the template instead.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policy.html}
+ */
+export type VerifiedPermissionsPolicyProps = {
+    /**
+     * Specifies the policy type and content to use for the new or updated policy. The definition structure must include either a `Static` or a `TemplateLinked` element.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policy.html#cfn-verifiedpermissions-policy-definition}
+     */
+    Definition: PolicyDefinition;
+    /**
+     * Specifies the `PolicyStoreId` of the policy store you want to store the policy in.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policy.html#cfn-verifiedpermissions-policy-policystoreid}
+     */
+    PolicyStoreId: string;
+};
+/**
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policy.html#aws-resource-verifiedpermissions-policy-return-values}
+ */
+export type VerifiedPermissionsPolicyAttribs = {
+    /**
+     * The unique ID of the new or updated policy.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policy.html#cfn-verifiedpermissions-policy-policyid}
+     */
+    PolicyId: string;
+    /**
+     * The type of the policy. This is one of the following values:
+     *
+     * - Static
+     * - TemplateLinked
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policy.html#cfn-verifiedpermissions-policy-policytype}
+     */
+    PolicyType: PolicyType;
+};
+/**
+ * Contains the identifier of an entity in a policy, including its ID and type.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-entityidentifier.html}
+ */
+export type EntityIdentifier = {
+    /**
+     * The identifier of an entity.
+     *
+     * `"entityId":" *identifier* "`
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^.*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-entityidentifier.html#cfn-verifiedpermissions-policy-entityidentifier-entityid}
+     */
+    EntityId: string;
+    /**
+     * The type of an entity.
+     *
+     * Example: `"entityType":" *typeName* "`
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^.*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-entityidentifier.html#cfn-verifiedpermissions-policy-entityidentifier-entitytype}
+     */
+    EntityType: string;
+};
+/**
+ * A structure that defines a Cedar policy. It includes the policy type, a description, and a policy body. This is a top level data type used to create a policy.
+ *
+ * This data type is used as a request parameter for the [CreatePolicy](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreatePolicy.html) operation. This structure must always have either an `Static` or a `TemplateLinked` element.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-policydefinition.html}
+ */
+export type PolicyDefinition = {
+    Static: StaticPolicyDefinition;
+} | {
+    TemplateLinked: TemplateLinkedPolicyDefinition;
+};
+/**
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-policytype.html}
+ */
+export type PolicyType = "STATIC" | "TEMPLATE_LINKED";
+/**
+ * A structure that defines a static policy.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-staticpolicydefinition.html}
+ */
+export type StaticPolicyDefinition = {
+    /**
+     * The description of the static policy.
+     * @minLength 0
+     * @maxLength 150
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-staticpolicydefinition.html#cfn-verifiedpermissions-policy-staticpolicydefinition-description}
+     */
+    Description?: string | undefined;
+    /**
+     * The policy content of the static policy, written in the Cedar policy language.
+     * @minLength 1
+     * @maxLength 10000
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-staticpolicydefinition.html#cfn-verifiedpermissions-policy-staticpolicydefinition-statement}
+     */
+    Statement: string;
+};
+/**
+ * A structure that describes a policy created by instantiating a policy template.
+ *
+ * > You can't directly update a template-linked policy. You must update the associated policy template instead.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-templatelinkedpolicydefinition.html}
+ */
+export type TemplateLinkedPolicyDefinition = {
+    /**
+     * The unique identifier of the policy template used to create this policy.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-templatelinkedpolicydefinition.html#cfn-verifiedpermissions-policy-templatelinkedpolicydefinition-policytemplateid}
+     */
+    PolicyTemplateId: string;
+    /**
+     * The principal associated with this template-linked policy. Verified Permissions substitutes this principal for the `?principal` placeholder in the policy template when it evaluates an authorization request.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-templatelinkedpolicydefinition.html#cfn-verifiedpermissions-policy-templatelinkedpolicydefinition-principal}
+     */
+    Principal?: EntityIdentifier | undefined;
+    /**
+     * The resource associated with this template-linked policy. Verified Permissions substitutes this resource for the `?resource` placeholder in the policy template when it evaluates an authorization request.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policy-templatelinkedpolicydefinition.html#cfn-verifiedpermissions-policy-templatelinkedpolicydefinition-resource}
+     */
+    Resource?: EntityIdentifier | undefined;
+};
+//# sourceMappingURL=aws-verifiedpermissions-policy.d.ts.map

package/out/exports/resources.generated/aws-verifiedpermissions-policystore.d.ts

@@ -0,0 +1,111 @@
+import type { ResourceDefinitionWithAttributes, Tag } from "../main.ts";
+/**
+ * Creates a policy store. A policy store is a container for policy resources. You can create a separate policy store for each of your applications.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html}
+ */
+export type VerifiedPermissionsPolicyStore = ResourceDefinitionWithAttributes<"AWS::VerifiedPermissions::PolicyStore", VerifiedPermissionsPolicyStoreProps, VerifiedPermissionsPolicyStoreAttribs>;
+/**
+ * Creates a policy store. A policy store is a container for policy resources. You can create a separate policy store for each of your applications.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html}
+ */
+export type VerifiedPermissionsPolicyStoreProps = {
+    /**
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-deletionprotection}
+     */
+    DeletionProtection?: DeletionProtection | undefined;
+    /**
+     * Descriptive text that you can provide to help with identification of the current policy store.
+     * @minLength 0
+     * @maxLength 150
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-description}
+     */
+    Description?: string | undefined;
+    /**
+     * Creates or updates the policy schema in a policy store. Cedar can use the schema to validate any Cedar policies and policy templates submitted to the policy store. Any changes to the schema validate only policies and templates submitted after the schema change. Existing policies and templates are not re-evaluated against the changed schema. If you later update a policy, then it is evaluated against the new schema at that time.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-schema}
+     */
+    Schema?: SchemaDefinition | undefined;
+    /**
+     * The list of key-value pairs to associate with the policy store.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-tags}
+     */
+    Tags?: Tag[] | undefined;
+    /**
+     * Specifies the validation setting for this policy store.
+     *
+     * Currently, the only valid and required value is `Mode` .
+     *
+     * > We recommend that you turn on `STRICT` mode only after you define a schema. If a schema doesn't exist, then `STRICT` mode causes any policy to fail validation, and Verified Permissions rejects the policy. You can turn off validation by using the [UpdatePolicyStore](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyStore) . Then, when you have a schema defined, use [UpdatePolicyStore](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_UpdatePolicyStore) again to turn validation back on.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-validationsettings}
+     */
+    ValidationSettings: ValidationSettings;
+};
+/**
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#aws-resource-verifiedpermissions-policystore-return-values}
+ */
+export type VerifiedPermissionsPolicyStoreAttribs = {
+    /**
+     * The [Amazon Resource Name (ARN)](https://docs.aws.amazon.com//general/latest/gr/aws-arns-and-namespaces.html) of the new or updated policy store.
+     * @minLength 1
+     * @maxLength 2500
+     * @pattern ^arn:[^:]*:[^:]*:[^:]*:[^:]*:.*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-arn}
+     */
+    Arn: string;
+    /**
+     * The unique ID of the new or updated policy store.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policystore.html#cfn-verifiedpermissions-policystore-policystoreid}
+     */
+    PolicyStoreId: string;
+};
+/**
+ * @default "DISABLED"
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-deletionmode.html}
+ */
+export type DeletionMode = "ENABLED" | "DISABLED";
+/**
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-deletionprotection.html}
+ */
+export type DeletionProtection = {
+    /**
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-deletionprotection.html#cfn-verifiedpermissions-policystore-deletionprotection-mode}
+     */
+    Mode: DeletionMode;
+};
+/**
+ * Contains a list of principal types, resource types, and actions that can be specified in policies stored in the same policy store. If the validation mode for the policy store is set to `STRICT` , then policies that can't be validated by this schema are rejected by Verified Permissions and can't be stored in the policy store.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-schemadefinition.html}
+ */
+export type SchemaDefinition = {
+    /**
+     * A JSON string representation of the schema supported by applications that use this policy store. For more information, see [Policy store schema](https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/schema.html) in the AVP User Guide.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-schemadefinition.html#cfn-verifiedpermissions-policystore-schemadefinition-cedarjson}
+     */
+    CedarJson?: string | undefined;
+};
+/**
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-validationmode.html}
+ */
+export type ValidationMode = "OFF" | "STRICT";
+/**
+ * A structure that contains Cedar policy validation settings for the policy store. The validation mode determines which validation failures that Cedar considers serious enough to block acceptance of a new or edited static policy or policy template.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-validationsettings.html}
+ */
+export type ValidationSettings = {
+    /**
+     * The validation mode currently configured for this policy store. The valid values are:
+     *
+     * - *OFF* – Neither Verified Permissions nor Cedar perform any validation on policies. No validation errors are reported by either service.
+     * - *STRICT* – Requires a schema to be present in the policy store. Cedar performs validation on all submitted new or updated static policies and policy templates. Any that fail validation are rejected and Cedar doesn't store them in the policy store.
+     *
+     * > If `Mode=STRICT` and the policy store doesn't contain a schema, Verified Permissions rejects all static policies and policy templates because there is no schema to validate against.
+     * >
+     * > To submit a static policy or policy template without a schema, you must turn off validation.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-verifiedpermissions-policystore-validationsettings.html#cfn-verifiedpermissions-policystore-validationsettings-mode}
+     */
+    Mode: ValidationMode;
+};
+//# sourceMappingURL=aws-verifiedpermissions-policystore.d.ts.map

package/out/exports/resources.generated/aws-verifiedpermissions-policytemplate.d.ts

@@ -0,0 +1,48 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+/**
+ * Creates a policy template. A template can use placeholders for the principal and resource. A template must be instantiated into a policy by associating it with specific principals and resources to use for the placeholders. That instantiated policy can then be considered in authorization decisions. The instantiated policy works identically to any other policy, except that it is dynamically linked to the template. If the template changes, then any policies that are linked to that template are immediately updated as well.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policytemplate.html}
+ */
+export type VerifiedPermissionsPolicyTemplate = ResourceDefinitionWithAttributes<"AWS::VerifiedPermissions::PolicyTemplate", VerifiedPermissionsPolicyTemplateProps, VerifiedPermissionsPolicyTemplateAttribs>;
+/**
+ * Creates a policy template. A template can use placeholders for the principal and resource. A template must be instantiated into a policy by associating it with specific principals and resources to use for the placeholders. That instantiated policy can then be considered in authorization decisions. The instantiated policy works identically to any other policy, except that it is dynamically linked to the template. If the template changes, then any policies that are linked to that template are immediately updated as well.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policytemplate.html}
+ */
+export type VerifiedPermissionsPolicyTemplateProps = {
+    /**
+     * The description to attach to the new or updated policy template.
+     * @minLength 0
+     * @maxLength 150
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policytemplate.html#cfn-verifiedpermissions-policytemplate-description}
+     */
+    Description?: string | undefined;
+    /**
+     * The unique identifier of the policy store that contains the template.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policytemplate.html#cfn-verifiedpermissions-policytemplate-policystoreid}
+     */
+    PolicyStoreId: string;
+    /**
+     * Specifies the content that you want to use for the new policy template, written in the Cedar policy language.
+     * @minLength 1
+     * @maxLength 10000
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policytemplate.html#cfn-verifiedpermissions-policytemplate-statement}
+     */
+    Statement: string;
+};
+/**
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policytemplate.html#aws-resource-verifiedpermissions-policytemplate-return-values}
+ */
+export type VerifiedPermissionsPolicyTemplateAttribs = {
+    /**
+     * The unique identifier of the new or modified policy template.
+     * @minLength 1
+     * @maxLength 200
+     * @pattern ^[a-zA-Z0-9-]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-verifiedpermissions-policytemplate.html#cfn-verifiedpermissions-policytemplate-policytemplateid}
+     */
+    PolicyTemplateId: string;
+};
+//# sourceMappingURL=aws-verifiedpermissions-policytemplate.d.ts.map

package/out/exports/resources.generated/aws-voiceid-domain.d.ts

@@ -0,0 +1,65 @@
+import type { ResourceDefinitionWithAttributes, Tag } from "../main.ts";
+/**
+ * Creates a domain that contains all Amazon Connect Voice ID data, such as speakers, fraudsters, customer audio, and voiceprints. Every domain is created with a default watchlist that fraudsters can be a part of.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-voiceid-domain.html}
+ */
+export type VoiceIDDomain = ResourceDefinitionWithAttributes<"AWS::VoiceID::Domain", VoiceIDDomainProps, VoiceIDDomainAttribs>;
+/**
+ * Creates a domain that contains all Amazon Connect Voice ID data, such as speakers, fraudsters, customer audio, and voiceprints. Every domain is created with a default watchlist that fraudsters can be a part of.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-voiceid-domain.html}
+ */
+export type VoiceIDDomainProps = {
+    /**
+     * The description of the domain.
+     * @minLength 1
+     * @maxLength 1024
+     * @pattern ^([\p{L}\p{Z}\p{N}_.:/=+\-%@]*)$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-voiceid-domain.html#cfn-voiceid-domain-description}
+     */
+    Description?: string | undefined;
+    /**
+     * The name for the domain.
+     * @minLength 1
+     * @maxLength 256
+     * @pattern ^[a-zA-Z0-9][a-zA-Z0-9_-]*$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-voiceid-domain.html#cfn-voiceid-domain-name}
+     */
+    Name: string;
+    /**
+     * The server-side encryption configuration containing the KMS key identifier you want Voice ID to use to encrypt your data.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-voiceid-domain.html#cfn-voiceid-domain-serversideencryptionconfiguration}
+     */
+    ServerSideEncryptionConfiguration: ServerSideEncryptionConfiguration;
+    /**
+     * The tags used to organize, track, or control access for this resource.
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-voiceid-domain.html#cfn-voiceid-domain-tags}
+     */
+    Tags?: Tag[] | undefined;
+};
+/**
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-voiceid-domain.html#aws-resource-voiceid-domain-return-values}
+ */
+export type VoiceIDDomainAttribs = {
+    /**
+     * The identifier of the domain.
+     * @minLength 22
+     * @maxLength 22
+     * @pattern ^[a-zA-Z0-9]{22}$
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-voiceid-domain.html#cfn-voiceid-domain-domainid}
+     */
+    DomainId: string;
+};
+/**
+ * The configuration containing information about the customer managed key used for encrypting customer data.
+ * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-voiceid-domain-serversideencryptionconfiguration.html}
+ */
+export type ServerSideEncryptionConfiguration = {
+    /**
+     * The identifier of the KMS key to use to encrypt data stored by Voice ID. Voice ID doesn't support asymmetric customer managed keys.
+     * @minLength 1
+     * @maxLength 2048
+     * @see {@link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-voiceid-domain-serversideencryptionconfiguration.html#cfn-voiceid-domain-serversideencryptionconfiguration-kmskeyid}
+     */
+    KmsKeyId: string;
+};
+//# sourceMappingURL=aws-voiceid-domain.d.ts.map