@pulumi/aws 6.0.0-alpha.2 → 6.0.0-alpha.4

package/cognito/managedUserPoolClient.d.ts

@@ -0,0 +1,394 @@
+import * as pulumi from "@pulumi/pulumi";
+import * as inputs from "../types/input";
+import * as outputs from "../types/output";
+/**
+ * Use the `aws.cognito.UserPoolClient` resource to manage a Cognito User Pool Client.
+ *
+ * **This resource is advanced** and has special caveats to consider before use. Please read this document completely before using the resource.
+ *
+ * Use the `aws.cognito.ManagedUserPoolClient` resource to manage a Cognito User Pool Client that is automatically created by an AWS service. For instance, when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html), the OpenSearch service creates the User Pool Client during setup and removes it when it is no longer required. As a result, the `aws.cognito.ManagedUserPoolClient` resource does not create or delete this resource, but instead assumes management of it.
+ *
+ * Use the `aws.cognito.UserPoolClient` resource to manage Cognito User Pool Clients for normal use cases.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const exampleUserPool = new aws.cognito.UserPool("exampleUserPool", {});
+ * const exampleIdentityPool = new aws.cognito.IdentityPool("exampleIdentityPool", {identityPoolName: "example"});
+ * const current = aws.getPartition({});
+ * const examplePolicyDocument = current.then(current => aws.iam.getPolicyDocument({
+ *     statements: [{
+ *         sid: "",
+ *         actions: ["sts:AssumeRole"],
+ *         effect: "Allow",
+ *         principals: [{
+ *             type: "Service",
+ *             identifiers: [`es.${current.dnsSuffix}`],
+ *         }],
+ *     }],
+ * }));
+ * const exampleRole = new aws.iam.Role("exampleRole", {
+ *     path: "/service-role/",
+ *     assumeRolePolicy: examplePolicyDocument.then(examplePolicyDocument => examplePolicyDocument.json),
+ * });
+ * const exampleRolePolicyAttachment = new aws.iam.RolePolicyAttachment("exampleRolePolicyAttachment", {
+ *     role: exampleRole.name,
+ *     policyArn: current.then(current => `arn:${current.partition}:iam::aws:policy/AmazonESCognitoAccess`),
+ * });
+ * const exampleDomain = new aws.opensearch.Domain("exampleDomain", {
+ *     cognitoOptions: {
+ *         enabled: true,
+ *         userPoolId: exampleUserPool.id,
+ *         identityPoolId: exampleIdentityPool.id,
+ *         roleArn: exampleRole.arn,
+ *     },
+ *     ebsOptions: {
+ *         ebsEnabled: true,
+ *         volumeSize: 10,
+ *     },
+ * }, {
+ *     dependsOn: [
+ *         aws_cognito_user_pool_domain.example,
+ *         exampleRolePolicyAttachment,
+ *     ],
+ * });
+ * const exampleManagedUserPoolClient = new aws.cognito.ManagedUserPoolClient("exampleManagedUserPoolClient", {
+ *     namePrefix: "AmazonOpenSearchService-example",
+ *     userPoolId: exampleUserPool.id,
+ * }, {
+ *     dependsOn: [exampleDomain],
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * To import Cognito User Pool Clients, use the `id` of the Cognito User Pool and the `id` of the Cognito User Pool Client. For example
+ *
+ * ```sh
+ *  $ pulumi import aws:cognito/managedUserPoolClient:ManagedUserPoolClient client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
+ * ```
+ */
+export declare class ManagedUserPoolClient extends pulumi.CustomResource {
+    /**
+     * Get an existing ManagedUserPoolClient resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ManagedUserPoolClientState, opts?: pulumi.CustomResourceOptions): ManagedUserPoolClient;
+    /**
+     * Returns true if the given object is an instance of ManagedUserPoolClient.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj: any): obj is ManagedUserPoolClient;
+    /**
+     * Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.access_token`.
+     */
+    readonly accessTokenValidity: pulumi.Output<number>;
+    /**
+     * List of allowed OAuth flows, including code, implicit, and client_credentials.
+     */
+    readonly allowedOauthFlows: pulumi.Output<string[]>;
+    /**
+     * Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.
+     */
+    readonly allowedOauthFlowsUserPoolClient: pulumi.Output<boolean>;
+    /**
+     * List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.
+     */
+    readonly allowedOauthScopes: pulumi.Output<string[]>;
+    /**
+     * Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.
+     */
+    readonly analyticsConfiguration: pulumi.Output<outputs.cognito.ManagedUserPoolClientAnalyticsConfiguration | undefined>;
+    /**
+     * Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for `authSessionValidity` are between `3` and `15`, with a default value of `3`.
+     */
+    readonly authSessionValidity: pulumi.Output<number>;
+    /**
+     * List of allowed callback URLs for the identity providers.
+     */
+    readonly callbackUrls: pulumi.Output<string[]>;
+    /**
+     * Client secret of the user pool client.
+     */
+    readonly clientSecret: pulumi.Output<string>;
+    /**
+     * Default redirect URI and must be included in the list of callback URLs.
+     */
+    readonly defaultRedirectUri: pulumi.Output<string>;
+    /**
+     * Enables the propagation of additional user context data.
+     */
+    readonly enablePropagateAdditionalUserContextData: pulumi.Output<boolean>;
+    /**
+     * Enables or disables token revocation.
+     */
+    readonly enableTokenRevocation: pulumi.Output<boolean>;
+    /**
+     * List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.
+     */
+    readonly explicitAuthFlows: pulumi.Output<string[]>;
+    /**
+     * Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.id_token`.
+     */
+    readonly idTokenValidity: pulumi.Output<number>;
+    /**
+     * List of allowed logout URLs for the identity providers.
+     */
+    readonly logoutUrls: pulumi.Output<string[]>;
+    /**
+     * Name of the user pool client.
+     */
+    readonly name: pulumi.Output<string>;
+    /**
+     * Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.
+     */
+    readonly namePattern: pulumi.Output<string | undefined>;
+    /**
+     * String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.
+     *
+     * The following arguments are optional:
+     */
+    readonly namePrefix: pulumi.Output<string | undefined>;
+    /**
+     * Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.
+     */
+    readonly preventUserExistenceErrors: pulumi.Output<string>;
+    /**
+     * List of user pool attributes that the application client can read from.
+     */
+    readonly readAttributes: pulumi.Output<string[]>;
+    /**
+     * Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in `token_validity_units.refresh_token`.
+     */
+    readonly refreshTokenValidity: pulumi.Output<number>;
+    /**
+     * List of provider names for the identity providers that are supported on this client. It uses the `providerName` attribute of the `aws.cognito.IdentityProvider` resource(s), or the equivalent string(s).
+     */
+    readonly supportedIdentityProviders: pulumi.Output<string[]>;
+    /**
+     * Configuration block for representing the validity times in units. See details below. Detailed below.
+     */
+    readonly tokenValidityUnits: pulumi.Output<outputs.cognito.ManagedUserPoolClientTokenValidityUnits | undefined>;
+    /**
+     * User pool that the client belongs to.
+     */
+    readonly userPoolId: pulumi.Output<string>;
+    /**
+     * List of user pool attributes that the application client can write to.
+     */
+    readonly writeAttributes: pulumi.Output<string[]>;
+    /**
+     * Create a ManagedUserPoolClient resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: ManagedUserPoolClientArgs, opts?: pulumi.CustomResourceOptions);
+}
+/**
+ * Input properties used for looking up and filtering ManagedUserPoolClient resources.
+ */
+export interface ManagedUserPoolClientState {
+    /**
+     * Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.access_token`.
+     */
+    accessTokenValidity?: pulumi.Input<number>;
+    /**
+     * List of allowed OAuth flows, including code, implicit, and client_credentials.
+     */
+    allowedOauthFlows?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.
+     */
+    allowedOauthFlowsUserPoolClient?: pulumi.Input<boolean>;
+    /**
+     * List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.
+     */
+    allowedOauthScopes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.
+     */
+    analyticsConfiguration?: pulumi.Input<inputs.cognito.ManagedUserPoolClientAnalyticsConfiguration>;
+    /**
+     * Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for `authSessionValidity` are between `3` and `15`, with a default value of `3`.
+     */
+    authSessionValidity?: pulumi.Input<number>;
+    /**
+     * List of allowed callback URLs for the identity providers.
+     */
+    callbackUrls?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Client secret of the user pool client.
+     */
+    clientSecret?: pulumi.Input<string>;
+    /**
+     * Default redirect URI and must be included in the list of callback URLs.
+     */
+    defaultRedirectUri?: pulumi.Input<string>;
+    /**
+     * Enables the propagation of additional user context data.
+     */
+    enablePropagateAdditionalUserContextData?: pulumi.Input<boolean>;
+    /**
+     * Enables or disables token revocation.
+     */
+    enableTokenRevocation?: pulumi.Input<boolean>;
+    /**
+     * List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.
+     */
+    explicitAuthFlows?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.id_token`.
+     */
+    idTokenValidity?: pulumi.Input<number>;
+    /**
+     * List of allowed logout URLs for the identity providers.
+     */
+    logoutUrls?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Name of the user pool client.
+     */
+    name?: pulumi.Input<string>;
+    /**
+     * Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.
+     */
+    namePattern?: pulumi.Input<string>;
+    /**
+     * String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.
+     *
+     * The following arguments are optional:
+     */
+    namePrefix?: pulumi.Input<string>;
+    /**
+     * Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.
+     */
+    preventUserExistenceErrors?: pulumi.Input<string>;
+    /**
+     * List of user pool attributes that the application client can read from.
+     */
+    readAttributes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in `token_validity_units.refresh_token`.
+     */
+    refreshTokenValidity?: pulumi.Input<number>;
+    /**
+     * List of provider names for the identity providers that are supported on this client. It uses the `providerName` attribute of the `aws.cognito.IdentityProvider` resource(s), or the equivalent string(s).
+     */
+    supportedIdentityProviders?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Configuration block for representing the validity times in units. See details below. Detailed below.
+     */
+    tokenValidityUnits?: pulumi.Input<inputs.cognito.ManagedUserPoolClientTokenValidityUnits>;
+    /**
+     * User pool that the client belongs to.
+     */
+    userPoolId?: pulumi.Input<string>;
+    /**
+     * List of user pool attributes that the application client can write to.
+     */
+    writeAttributes?: pulumi.Input<pulumi.Input<string>[]>;
+}
+/**
+ * The set of arguments for constructing a ManagedUserPoolClient resource.
+ */
+export interface ManagedUserPoolClientArgs {
+    /**
+     * Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.access_token`.
+     */
+    accessTokenValidity?: pulumi.Input<number>;
+    /**
+     * List of allowed OAuth flows, including code, implicit, and client_credentials.
+     */
+    allowedOauthFlows?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Whether the client is allowed to use the OAuth protocol when interacting with Cognito user pools.
+     */
+    allowedOauthFlowsUserPoolClient?: pulumi.Input<boolean>;
+    /**
+     * List of allowed OAuth scopes, including phone, email, openid, profile, and aws.cognito.signin.user.admin.
+     */
+    allowedOauthScopes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Configuration block for Amazon Pinpoint analytics that collects metrics for this user pool. See details below.
+     */
+    analyticsConfiguration?: pulumi.Input<inputs.cognito.ManagedUserPoolClientAnalyticsConfiguration>;
+    /**
+     * Duration, in minutes, of the session token created by Amazon Cognito for each API request in an authentication flow. The session token must be responded to by the native user of the user pool before it expires. Valid values for `authSessionValidity` are between `3` and `15`, with a default value of `3`.
+     */
+    authSessionValidity?: pulumi.Input<number>;
+    /**
+     * List of allowed callback URLs for the identity providers.
+     */
+    callbackUrls?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Default redirect URI and must be included in the list of callback URLs.
+     */
+    defaultRedirectUri?: pulumi.Input<string>;
+    /**
+     * Enables the propagation of additional user context data.
+     */
+    enablePropagateAdditionalUserContextData?: pulumi.Input<boolean>;
+    /**
+     * Enables or disables token revocation.
+     */
+    enableTokenRevocation?: pulumi.Input<boolean>;
+    /**
+     * List of authentication flows. The available options include ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_REFRESH_TOKEN_AUTH.
+     */
+    explicitAuthFlows?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. By default, the unit is hours. The unit can be overridden by a value in `token_validity_units.id_token`.
+     */
+    idTokenValidity?: pulumi.Input<number>;
+    /**
+     * List of allowed logout URLs for the identity providers.
+     */
+    logoutUrls?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Regular expression that matches the name of the desired User Pool Client. It must only match one User Pool Client.
+     */
+    namePattern?: pulumi.Input<string>;
+    /**
+     * String that matches the beginning of the name of the desired User Pool Client. It must match only one User Pool Client.
+     *
+     * The following arguments are optional:
+     */
+    namePrefix?: pulumi.Input<string>;
+    /**
+     * Setting determines the errors and responses returned by Cognito APIs when a user does not exist in the user pool during authentication, account confirmation, and password recovery.
+     */
+    preventUserExistenceErrors?: pulumi.Input<string>;
+    /**
+     * List of user pool attributes that the application client can read from.
+     */
+    readAttributes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Time limit, between 60 minutes and 10 years, after which the refresh token is no longer valid and cannot be used. By default, the unit is days. The unit can be overridden by a value in `token_validity_units.refresh_token`.
+     */
+    refreshTokenValidity?: pulumi.Input<number>;
+    /**
+     * List of provider names for the identity providers that are supported on this client. It uses the `providerName` attribute of the `aws.cognito.IdentityProvider` resource(s), or the equivalent string(s).
+     */
+    supportedIdentityProviders?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Configuration block for representing the validity times in units. See details below. Detailed below.
+     */
+    tokenValidityUnits?: pulumi.Input<inputs.cognito.ManagedUserPoolClientTokenValidityUnits>;
+    /**
+     * User pool that the client belongs to.
+     */
+    userPoolId: pulumi.Input<string>;
+    /**
+     * List of user pool attributes that the application client can write to.
+     */
+    writeAttributes?: pulumi.Input<pulumi.Input<string>[]>;
+}

package/cognito/managedUserPoolClient.js

@@ -0,0 +1,170 @@
+"use strict";
+// *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManagedUserPoolClient = void 0;
+const pulumi = require("@pulumi/pulumi");
+const utilities = require("../utilities");
+/**
+ * Use the `aws.cognito.UserPoolClient` resource to manage a Cognito User Pool Client.
+ *
+ * **This resource is advanced** and has special caveats to consider before use. Please read this document completely before using the resource.
+ *
+ * Use the `aws.cognito.ManagedUserPoolClient` resource to manage a Cognito User Pool Client that is automatically created by an AWS service. For instance, when [configuring an OpenSearch Domain to use Cognito authentication](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/cognito-auth.html), the OpenSearch service creates the User Pool Client during setup and removes it when it is no longer required. As a result, the `aws.cognito.ManagedUserPoolClient` resource does not create or delete this resource, but instead assumes management of it.
+ *
+ * Use the `aws.cognito.UserPoolClient` resource to manage Cognito User Pool Clients for normal use cases.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as aws from "@pulumi/aws";
+ *
+ * const exampleUserPool = new aws.cognito.UserPool("exampleUserPool", {});
+ * const exampleIdentityPool = new aws.cognito.IdentityPool("exampleIdentityPool", {identityPoolName: "example"});
+ * const current = aws.getPartition({});
+ * const examplePolicyDocument = current.then(current => aws.iam.getPolicyDocument({
+ *     statements: [{
+ *         sid: "",
+ *         actions: ["sts:AssumeRole"],
+ *         effect: "Allow",
+ *         principals: [{
+ *             type: "Service",
+ *             identifiers: [`es.${current.dnsSuffix}`],
+ *         }],
+ *     }],
+ * }));
+ * const exampleRole = new aws.iam.Role("exampleRole", {
+ *     path: "/service-role/",
+ *     assumeRolePolicy: examplePolicyDocument.then(examplePolicyDocument => examplePolicyDocument.json),
+ * });
+ * const exampleRolePolicyAttachment = new aws.iam.RolePolicyAttachment("exampleRolePolicyAttachment", {
+ *     role: exampleRole.name,
+ *     policyArn: current.then(current => `arn:${current.partition}:iam::aws:policy/AmazonESCognitoAccess`),
+ * });
+ * const exampleDomain = new aws.opensearch.Domain("exampleDomain", {
+ *     cognitoOptions: {
+ *         enabled: true,
+ *         userPoolId: exampleUserPool.id,
+ *         identityPoolId: exampleIdentityPool.id,
+ *         roleArn: exampleRole.arn,
+ *     },
+ *     ebsOptions: {
+ *         ebsEnabled: true,
+ *         volumeSize: 10,
+ *     },
+ * }, {
+ *     dependsOn: [
+ *         aws_cognito_user_pool_domain.example,
+ *         exampleRolePolicyAttachment,
+ *     ],
+ * });
+ * const exampleManagedUserPoolClient = new aws.cognito.ManagedUserPoolClient("exampleManagedUserPoolClient", {
+ *     namePrefix: "AmazonOpenSearchService-example",
+ *     userPoolId: exampleUserPool.id,
+ * }, {
+ *     dependsOn: [exampleDomain],
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * To import Cognito User Pool Clients, use the `id` of the Cognito User Pool and the `id` of the Cognito User Pool Client. For example
+ *
+ * ```sh
+ *  $ pulumi import aws:cognito/managedUserPoolClient:ManagedUserPoolClient client us-west-2_abc123/3ho4ek12345678909nh3fmhpko
+ * ```
+ */
+class ManagedUserPoolClient extends pulumi.CustomResource {
+    /**
+     * Get an existing ManagedUserPoolClient resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name, id, state, opts) {
+        return new ManagedUserPoolClient(name, state, Object.assign(Object.assign({}, opts), { id: id }));
+    }
+    /**
+     * Returns true if the given object is an instance of ManagedUserPoolClient.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === ManagedUserPoolClient.__pulumiType;
+    }
+    constructor(name, argsOrState, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState;
+            resourceInputs["accessTokenValidity"] = state ? state.accessTokenValidity : undefined;
+            resourceInputs["allowedOauthFlows"] = state ? state.allowedOauthFlows : undefined;
+            resourceInputs["allowedOauthFlowsUserPoolClient"] = state ? state.allowedOauthFlowsUserPoolClient : undefined;
+            resourceInputs["allowedOauthScopes"] = state ? state.allowedOauthScopes : undefined;
+            resourceInputs["analyticsConfiguration"] = state ? state.analyticsConfiguration : undefined;
+            resourceInputs["authSessionValidity"] = state ? state.authSessionValidity : undefined;
+            resourceInputs["callbackUrls"] = state ? state.callbackUrls : undefined;
+            resourceInputs["clientSecret"] = state ? state.clientSecret : undefined;
+            resourceInputs["defaultRedirectUri"] = state ? state.defaultRedirectUri : undefined;
+            resourceInputs["enablePropagateAdditionalUserContextData"] = state ? state.enablePropagateAdditionalUserContextData : undefined;
+            resourceInputs["enableTokenRevocation"] = state ? state.enableTokenRevocation : undefined;
+            resourceInputs["explicitAuthFlows"] = state ? state.explicitAuthFlows : undefined;
+            resourceInputs["idTokenValidity"] = state ? state.idTokenValidity : undefined;
+            resourceInputs["logoutUrls"] = state ? state.logoutUrls : undefined;
+            resourceInputs["name"] = state ? state.name : undefined;
+            resourceInputs["namePattern"] = state ? state.namePattern : undefined;
+            resourceInputs["namePrefix"] = state ? state.namePrefix : undefined;
+            resourceInputs["preventUserExistenceErrors"] = state ? state.preventUserExistenceErrors : undefined;
+            resourceInputs["readAttributes"] = state ? state.readAttributes : undefined;
+            resourceInputs["refreshTokenValidity"] = state ? state.refreshTokenValidity : undefined;
+            resourceInputs["supportedIdentityProviders"] = state ? state.supportedIdentityProviders : undefined;
+            resourceInputs["tokenValidityUnits"] = state ? state.tokenValidityUnits : undefined;
+            resourceInputs["userPoolId"] = state ? state.userPoolId : undefined;
+            resourceInputs["writeAttributes"] = state ? state.writeAttributes : undefined;
+        }
+        else {
+            const args = argsOrState;
+            if ((!args || args.userPoolId === undefined) && !opts.urn) {
+                throw new Error("Missing required property 'userPoolId'");
+            }
+            resourceInputs["accessTokenValidity"] = args ? args.accessTokenValidity : undefined;
+            resourceInputs["allowedOauthFlows"] = args ? args.allowedOauthFlows : undefined;
+            resourceInputs["allowedOauthFlowsUserPoolClient"] = args ? args.allowedOauthFlowsUserPoolClient : undefined;
+            resourceInputs["allowedOauthScopes"] = args ? args.allowedOauthScopes : undefined;
+            resourceInputs["analyticsConfiguration"] = args ? args.analyticsConfiguration : undefined;
+            resourceInputs["authSessionValidity"] = args ? args.authSessionValidity : undefined;
+            resourceInputs["callbackUrls"] = args ? args.callbackUrls : undefined;
+            resourceInputs["defaultRedirectUri"] = args ? args.defaultRedirectUri : undefined;
+            resourceInputs["enablePropagateAdditionalUserContextData"] = args ? args.enablePropagateAdditionalUserContextData : undefined;
+            resourceInputs["enableTokenRevocation"] = args ? args.enableTokenRevocation : undefined;
+            resourceInputs["explicitAuthFlows"] = args ? args.explicitAuthFlows : undefined;
+            resourceInputs["idTokenValidity"] = args ? args.idTokenValidity : undefined;
+            resourceInputs["logoutUrls"] = args ? args.logoutUrls : undefined;
+            resourceInputs["namePattern"] = args ? args.namePattern : undefined;
+            resourceInputs["namePrefix"] = args ? args.namePrefix : undefined;
+            resourceInputs["preventUserExistenceErrors"] = args ? args.preventUserExistenceErrors : undefined;
+            resourceInputs["readAttributes"] = args ? args.readAttributes : undefined;
+            resourceInputs["refreshTokenValidity"] = args ? args.refreshTokenValidity : undefined;
+            resourceInputs["supportedIdentityProviders"] = args ? args.supportedIdentityProviders : undefined;
+            resourceInputs["tokenValidityUnits"] = args ? args.tokenValidityUnits : undefined;
+            resourceInputs["userPoolId"] = args ? args.userPoolId : undefined;
+            resourceInputs["writeAttributes"] = args ? args.writeAttributes : undefined;
+            resourceInputs["clientSecret"] = undefined /*out*/;
+            resourceInputs["name"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["clientSecret"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(ManagedUserPoolClient.__pulumiType, name, resourceInputs, opts);
+    }
+}
+exports.ManagedUserPoolClient = ManagedUserPoolClient;
+/** @internal */
+ManagedUserPoolClient.__pulumiType = 'aws:cognito/managedUserPoolClient:ManagedUserPoolClient';
+//# sourceMappingURL=managedUserPoolClient.js.map

package/cognito/managedUserPoolClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managedUserPoolClient.js","sourceRoot":"","sources":["../../cognito/managedUserPoolClient.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AAIzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,MAAa,qBAAsB,SAAQ,MAAM,CAAC,cAAc;IAC5D;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAkC,EAAE,IAAmC;QAChI,OAAO,IAAI,qBAAqB,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IAC5E,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,qBAAqB,CAAC,YAAY,CAAC;IACtE,CAAC;IA6GD,YAAY,IAAY,EAAE,WAAoE,EAAE,IAAmC;QAC/H,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAAqD,CAAC;YACpE,cAAc,CAAC,qBAAqB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,cAAc,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,cAAc,CAAC,iCAAiC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9G,cAAc,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,cAAc,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5F,cAAc,CAAC,qBAAqB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,cAAc,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,cAAc,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,cAAc,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,cAAc,CAAC,0CAA0C,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChI,cAAc,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,cAAc,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,cAAc,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,4BAA4B,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;YACpG,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,cAAc,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,cAAc,CAAC,4BAA4B,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;YACpG,cAAc,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;SACjF;aAAM;YACH,MAAM,IAAI,GAAG,WAAoD,CAAC;YAClE,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACvD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;aAC7D;YACD,cAAc,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,cAAc,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,cAAc,CAAC,iCAAiC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5G,cAAc,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,cAAc,CAAC,wBAAwB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,cAAc,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,cAAc,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,cAAc,CAAC,0CAA0C,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9H,cAAc,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,cAAc,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,cAAc,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,cAAc,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,cAAc,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,cAAc,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,cAAc,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC9C;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,uBAAuB,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;QACjE,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,KAAK,CAAC,qBAAqB,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;;AAtML,sDAuMC;AAzLG,gBAAgB;AACO,kCAAY,GAAG,yDAAyD,CAAC"}

package/cognito/userPool.d.ts

@@ -156,7 +156,7 @@ export declare class UserPool extends pulumi.CustomResource {
      */
     readonly name: pulumi.Output<string>;
     /**
-     * Configuration blocked for information about the user pool password policy. Detailed below.
+     * Configuration block for information about the user pool password policy. Detailed below.
      */
     readonly passwordPolicy: pulumi.Output<outputs.cognito.UserPoolPasswordPolicy>;
     /**
@@ -303,7 +303,7 @@ export interface UserPoolState {
      */
     name?: pulumi.Input<string>;
     /**
-     * Configuration blocked for information about the user pool password policy. Detailed below.
+     * Configuration block for information about the user pool password policy. Detailed below.
      */
     passwordPolicy?: pulumi.Input<inputs.cognito.UserPoolPasswordPolicy>;
     /**
@@ -414,7 +414,7 @@ export interface UserPoolArgs {
      */
     name?: pulumi.Input<string>;
     /**
-     * Configuration blocked for information about the user pool password policy. Detailed below.
+     * Configuration block for information about the user pool password policy. Detailed below.
      */
     passwordPolicy?: pulumi.Input<inputs.cognito.UserPoolPasswordPolicy>;
     /**