You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Aug 7, 2025. It is now read-only.
Copy file name to clipboardExpand all lines: content/en/user-guide/aws/verifiedpermissions/index.md
-279Lines changed: 0 additions & 279 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -133,285 +133,6 @@ You should get the following output, indicating that your request was allowed:
133
133
}
134
134
```
135
135
136
-
## Integration with Cognito
137
-
138
-
Verified Permissions allows you to use external identity provider (IdP) via Identity Sources.
139
-
Your application can use JSON web tokens (JWTs) generated by your IdP in authorization requests.
140
-
The user identity in the token is mapped to the principal ID of the request.
141
-
142
-
With ID tokens, Verified Permissions maps attribute claims to principal attributes.
143
-
With Access tokens, these claims are mapped to context.
144
-
145
-
### Create a Cognito UserPool
146
-
To create a user pool, you can use the [`CreateUserPool`](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPool.html) API call.
147
-
The following command creates a user pool named `avp-test`:
You will need the user pool's `Id` and `Arn` for further operations.
180
-
181
-
### Create a User Pool Client
182
-
183
-
You can proceed with adding a client to the pool we just created.
184
-
You will require the ID of the newly created client for the subsequent steps.
185
-
You can use the [`CreateUserPoolClient`](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolClient.html) for both client creation and extraction of the corresponding ID.
186
-
Run the following command, replacing the `--user-pool-id` with the one from the previous step:
You can now create a user, which will be used when sending requests to Verified Permissions.
230
-
We will use `avp-user` for its username, and `avp@test.com` as its email address.
231
-
232
-
We can run the 4 following commands to create the user, add it to the Cognito Group then get the Identity Token and Access Token for the user.
233
-
You will need to replace the `--user-pool-id` from the User Pool `id` from the first step, and the `--client-id` with the User Pool Client `id` from the step above.
You will need the `policyStoreId` for the next commands.
302
-
303
-
### Create an Identity Source
304
-
305
-
You can now create an Identity Source, which is a representation of an external identity provider, Cognito in our case.
306
-
To create a Verified Permissions Identity Source, use the [`CreateIdentitySource`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html) API.
307
-
308
-
First, create a JSON file containing the following Identity Source configuration named `identity_source.json`.
309
-
Replace the `userPoolArn` with the User Pool `Arn` value from the previous step, and the `clientIds` value from the User Pool Client `Id`:
You will now create a Policy that will take advantage of the configuration of your Identity Source, and will provide access to the resource if the principal is part of the group type that was defined in the IdentitySource configuration, and the group identity that was defined in Cognito.
331
-
332
-
First, create a JSON file containing the following policy named `policy_cognito.json`:
333
-
334
-
```json
335
-
{
336
-
"static": {
337
-
"description": "Grant any User that is part of the UserGroup `` access to view the trip Album",
338
-
"statement": "permit(principal in UserGroup::\"AVPGroup\", action == Action::\"create\", resource == Album::\"vacations\");"
339
-
}
340
-
}
341
-
```
342
-
343
-
You can then run this command to create the policy:
344
-
{{< command >}}
345
-
$ awslocal verifiedpermissions create-policy \
346
-
--definition file://policy_cognito.json \
347
-
--policy-store-id ESIPIqX1pUHDvwqekZno1G
348
-
{{< /command >}}
349
-
350
-
You should see similiar output:
351
-
352
-
```json
353
-
{
354
-
"policyStoreId": "ESIPIqX1pUHDvwqekZno1G",
355
-
"policyId": "cF8X6thXBt5uCANQ8GAEK2",
356
-
"policyType": "STATIC",
357
-
"principal": {
358
-
"entityType": "UserGroup",
359
-
"entityId": "AVPGroup"
360
-
},
361
-
"resource": {
362
-
"entityType": "Album",
363
-
"entityId": "vacations"
364
-
},
365
-
"actions": [
366
-
{
367
-
"actionType": "Action",
368
-
"actionId": "create"
369
-
}
370
-
],
371
-
"createdDate": "2025-04-22T19:39:54.542438Z",
372
-
"lastUpdatedDate": "2025-04-22T19:39:54.542438Z",
373
-
"effect": "Permit"
374
-
}
375
-
```
376
-
377
-
### Authorize a request with a Cognito Token
378
-
379
-
Finally, you can use everything that we created above to authorize your request.
380
-
By using your user's Identity Token, you can run an authorization request that will authenticate your principal, and automatically use the information that its type is of `UserGroup::`, and the value will be from the token attribute `cognito:groups`.
381
-
382
-
To authorize a request with a token using Verified Permissions, use the [`IsAuthorizedWithToken`](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html) API.
383
-
384
-
You can run the following command to verify that you can authorize the request:
Additionally, you can have more advanced and complex scenarios using Cognito attributes and claims to provide more context to your authorization request.
413
-
Your policy can also use those additionals attributes to provide more fine-grained authorization.
414
-
415
136
## Current limitations
416
137
417
138
- No Schema validation when creating a new schema using `PutSchema`, and no Policy validation using said schema when creating policies and template policies.
0 commit comments