--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.16.0 name: userpoolclients.cognitoidentityprovider.aws.crossplane.io spec: group: cognitoidentityprovider.aws.crossplane.io names: categories: - crossplane - managed - aws kind: UserPoolClient listKind: UserPoolClientList plural: userpoolclients singular: userpoolclient scope: Cluster versions: - additionalPrinterColumns: - jsonPath: .status.conditions[?(@.type=='Ready')].status name: READY type: string - jsonPath: .status.conditions[?(@.type=='Synced')].status name: SYNCED type: string - jsonPath: .metadata.annotations.crossplane\.io/external-name name: EXTERNAL-NAME type: string - jsonPath: .metadata.creationTimestamp name: AGE type: date name: v1alpha1 schema: openAPIV3Schema: description: UserPoolClient is the Schema for the UserPoolClients API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: UserPoolClientSpec defines the desired state of UserPoolClient properties: deletionPolicy: default: Delete description: |- DeletionPolicy specifies what will happen to the underlying external when this managed resource is deleted - either "Delete" or "Orphan" the external resource. This field is planned to be deprecated in favor of the ManagementPolicies field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 enum: - Orphan - Delete type: string forProvider: description: UserPoolClientParameters defines the desired state of UserPoolClient properties: accessTokenValidity: description: |- The access token time limit. After this limit expires, your user can't use their access token. To specify the time unit for AccessTokenValidity as seconds, minutes, hours, or days, set a TokenValidityUnits value in your API request. For example, when you set AccessTokenValidity to 10 and TokenValidityUnits to hours, your user can authorize access with their access token for 10 hours. The default time unit for AccessTokenValidity in an API request is hours. Valid range is displayed below in seconds. If you don't specify otherwise in the configuration of your app client, your access tokens are valid for one hour. format: int64 type: integer allowedOAuthFlows: description: |- The allowed OAuth flows. code Use a code grant flow, which provides an authorization code as the response. This code can be exchanged for access tokens with the /oauth2/token endpoint. implicit Issue the access token (and, optionally, ID token, based on scopes) directly to your user. client_credentials Issue the access token from the /oauth2/token endpoint directly to a non-person user using a combination of the client ID and client secret. items: type: string type: array allowedOAuthFlowsUserPoolClient: description: |- Set to true to use OAuth 2.0 features in your user pool app client. AllowedOAuthFlowsUserPoolClient must be true before you can configure the following features in your app client. * CallBackURLs: Callback URLs. * LogoutURLs: Sign-out redirect URLs. * AllowedOAuthScopes: OAuth 2.0 scopes. * AllowedOAuthFlows: Support for authorization code, implicit, and client credentials OAuth 2.0 grants. To use OAuth 2.0 features, configure one of these features in the Amazon Cognito console or set AllowedOAuthFlowsUserPoolClient to true in a CreateUserPoolClient or UpdateUserPoolClient API request. If you don't set a value for AllowedOAuthFlowsUserPoolClient in a request with the CLI or SDKs, it defaults to false. type: boolean allowedOAuthScopes: description: |- The allowed OAuth scopes. Possible values provided by OAuth are phone, email, openid, and profile. Possible values provided by Amazon Web Services are aws.cognito.signin.user.admin. Custom scopes created in Resource Servers are also supported. items: type: string type: array analyticsConfiguration: description: |- The user pool analytics configuration for collecting metrics and sending them to your Amazon Pinpoint campaign. In Amazon Web Services Regions where Amazon Pinpoint isn't available, user pools only support sending events to Amazon Pinpoint projects in Amazon Web Services Region us-east-1. In Regions where Amazon Pinpoint is available, user pools support sending events to Amazon Pinpoint projects within that same Region. properties: applicationARN: type: string applicationID: type: string externalID: type: string roleARN: type: string userDataShared: type: boolean type: object authSessionValidity: description: |- Amazon Cognito creates a session token for each API request in an authentication flow. AuthSessionValidity is the duration, in minutes, of that session token. Your user pool native user must respond to each authentication challenge before the session expires. format: int64 type: integer callbackURLs: description: |- A list of allowed redirect (callback) URLs for the IdPs. A redirect URI must: * Be an absolute URI. * Be registered with the authorization server. * Not include a fragment component. See OAuth 2.0 - Redirection Endpoint (https://tools.ietf.org/html/rfc6749#section-3.1.2). Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes only. App callback URLs such as myapp://example are also supported. items: type: string type: array clientName: description: The client name for the user pool client you would like to create. type: string defaultRedirectURI: description: |- The default redirect URI. Must be in the CallbackURLs list. A redirect URI must: * Be an absolute URI. * Be registered with the authorization server. * Not include a fragment component. See OAuth 2.0 - Redirection Endpoint (https://tools.ietf.org/html/rfc6749#section-3.1.2). Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes only. App callback URLs such as myapp://example are also supported. type: string enablePropagateAdditionalUserContextData: description: |- Activates the propagation of additional user context data. For more information about propagation of user context data, see Adding advanced security to a user pool (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-advanced-security.html). If you don’t include this parameter, you can't send device fingerprint information, including source IP address, to Amazon Cognito advanced security. You can only activate EnablePropagateAdditionalUserContextData in an app client that has a client secret. type: boolean enableTokenRevocation: description: |- Activates or deactivates token revocation. For more information about revoking tokens, see RevokeToken (https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RevokeToken.html). If you don't include this parameter, token revocation is automatically activated for the new user pool client. type: boolean explicitAuthFlows: description: |- The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in your users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and password, or a custom authentication process that you define with Lambda functions. If you don't specify a value for ExplicitAuthFlows, your user client supports ALLOW_REFRESH_TOKEN_AUTH, ALLOW_USER_SRP_AUTH, and ALLOW_CUSTOM_AUTH. Valid values include: * ALLOW_ADMIN_USER_PASSWORD_AUTH: Enable admin based user password authentication flow ADMIN_USER_PASSWORD_AUTH. This setting replaces the ADMIN_NO_SRP_AUTH setting. With this authentication flow, your app passes a user name and password to Amazon Cognito in the request, instead of using the Secure Remote Password (SRP) protocol to securely transmit the password. * ALLOW_CUSTOM_AUTH: Enable Lambda trigger based authentication. * ALLOW_USER_PASSWORD_AUTH: Enable user password-based authentication. In this flow, Amazon Cognito receives the password in the request instead of using the SRP protocol to verify passwords. * ALLOW_USER_SRP_AUTH: Enable SRP-based authentication. * ALLOW_REFRESH_TOKEN_AUTH: Enable authflow to refresh tokens. In some environments, you will see the values ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, or USER_PASSWORD_AUTH. You can't assign these legacy ExplicitAuthFlows values to user pool clients at the same time as values that begin with ALLOW_, like ALLOW_USER_SRP_AUTH. items: type: string type: array generateSecret: description: |- Boolean to specify whether you want to generate a secret for the user pool client being created. type: boolean idTokenValidity: description: |- The ID token time limit. After this limit expires, your user can't use their ID token. To specify the time unit for IdTokenValidity as seconds, minutes, hours, or days, set a TokenValidityUnits value in your API request. For example, when you set IdTokenValidity as 10 and TokenValidityUnits as hours, your user can authenticate their session with their ID token for 10 hours. The default time unit for IdTokenValidity in an API request is hours. Valid range is displayed below in seconds. If you don't specify otherwise in the configuration of your app client, your ID tokens are valid for one hour. format: int64 type: integer logoutURLs: description: A list of allowed logout URLs for the IdPs. items: type: string type: array preventUserExistenceErrors: description: |- Errors and responses that you want Amazon Cognito APIs to return during authentication, account confirmation, and password recovery when the user doesn't exist in the user pool. When set to ENABLED and the user doesn't exist, authentication returns an error indicating either the username or password was incorrect. Account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to LEGACY, those APIs return a UserNotFoundException exception if the user doesn't exist in the user pool. Valid values include: * ENABLED - This prevents user existence-related errors. * LEGACY - This represents the early behavior of Amazon Cognito where user existence related errors aren't prevented. type: string readAttributes: description: The read attributes. items: type: string type: array refreshTokenValidity: description: |- The refresh token time limit. After this limit expires, your user can't use their refresh token. To specify the time unit for RefreshTokenValidity as seconds, minutes, hours, or days, set a TokenValidityUnits value in your API request. For example, when you set RefreshTokenValidity as 10 and TokenValidityUnits as days, your user can refresh their session and retrieve new access and ID tokens for 10 days. The default time unit for RefreshTokenValidity in an API request is days. You can't set RefreshTokenValidity to 0. If you do, Amazon Cognito overrides the value with the default value of 30 days. Valid range is displayed below in seconds. If you don't specify otherwise in the configuration of your app client, your refresh tokens are valid for 30 days. format: int64 type: integer region: description: Region is which region the UserPoolClient will be created. type: string supportedIdentityProviders: description: |- A list of provider names for the identity providers (IdPs) that are supported on this client. The following are supported: COGNITO, Facebook, Google, SignInWithApple, and LoginWithAmazon. You can also specify the names that you configured for the SAML and OIDC IdPs in your user pool, for example MySAMLIdP or MyOIDCIdP. items: type: string type: array tokenValidityUnits: description: |- The units in which the validity times are represented. The default unit for RefreshToken is days, and default for ID and access tokens are hours. properties: accessToken: type: string idToken: type: string refreshToken: type: string type: object userPoolId: description: The user pool ID. type: string userPoolIdRef: description: UserPoolIDRef is a reference to an server instance. properties: name: description: Name of the referenced object. type: string policy: description: Policies for referencing. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object required: - name type: object userPoolIdSelector: description: UserPoolIDSelector selects references to an server instance. properties: matchControllerRef: description: |- MatchControllerRef ensures an object with the same controller reference as the selecting object is selected. type: boolean matchLabels: additionalProperties: type: string description: MatchLabels ensures an object with matching labels is selected. type: object policy: description: Policies for selection. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object type: object writeAttributes: description: |- The user pool attributes that the app client can write to. If your app client allows users to sign in through an IdP, this array must include all attributes that you have mapped to IdP attributes. Amazon Cognito updates mapped attributes when users sign in to your application through an IdP. If your app client does not have write access to a mapped attribute, Amazon Cognito throws an error when it tries to update the attribute. For more information, see Specifying IdP Attribute Mappings for Your user pool (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-specifying-attribute-mapping.html). items: type: string type: array required: - clientName - region type: object managementPolicies: default: - '*' description: |- THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md items: description: |- A ManagementAction represents an action that the Crossplane controllers can take on an external resource. enum: - Observe - Create - Update - Delete - LateInitialize - '*' type: string type: array providerConfigRef: default: name: default description: |- ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured. properties: name: description: Name of the referenced object. type: string policy: description: Policies for referencing. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object required: - name type: object publishConnectionDetailsTo: description: |- PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. properties: configRef: default: name: default description: |- SecretStoreConfigRef specifies which secret store config should be used for this ConnectionSecret. properties: name: description: Name of the referenced object. type: string policy: description: Policies for referencing. properties: resolution: default: Required description: |- Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved. enum: - Required - Optional type: string resolve: description: |- Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile. enum: - Always - IfNotPresent type: string type: object required: - name type: object metadata: description: Metadata is the metadata for connection secret. properties: annotations: additionalProperties: type: string description: |- Annotations are the annotations to be added to connection secret. - For Kubernetes secrets, this will be used as "metadata.annotations". - It is up to Secret Store implementation for others store types. type: object labels: additionalProperties: type: string description: |- Labels are the labels/tags to be added to connection secret. - For Kubernetes secrets, this will be used as "metadata.labels". - It is up to Secret Store implementation for others store types. type: object type: description: |- Type is the SecretType for the connection secret. - Only valid for Kubernetes Secret Stores. type: string type: object name: description: Name is the name of the connection secret. type: string required: - name type: object writeConnectionSecretToRef: description: |- WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other. properties: name: description: Name of the secret. type: string namespace: description: Namespace of the secret. type: string required: - name - namespace type: object required: - forProvider type: object status: description: UserPoolClientStatus defines the observed state of UserPoolClient. properties: atProvider: description: UserPoolClientObservation defines the observed state of UserPoolClient properties: clientID: description: The ID of the client associated with the user pool. type: string clientSecret: description: The client secret from the user pool request of the client type. type: string creationDate: description: |- The date and time, in ISO 8601 (https://www.iso.org/iso-8601-date-and-time-format.html) format, when the item was created. format: date-time type: string lastModifiedDate: description: |- The date and time, in ISO 8601 (https://www.iso.org/iso-8601-date-and-time-format.html) format, when the item was modified. format: date-time type: string userPoolID: description: The user pool ID for the user pool client. type: string type: object conditions: description: Conditions of the resource. items: description: A Condition that may apply to a resource. properties: lastTransitionTime: description: |- LastTransitionTime is the last time this condition transitioned from one status to another. format: date-time type: string message: description: |- A Message containing details about this condition's last transition from one status to another, if any. type: string observedGeneration: description: |- ObservedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 type: integer reason: description: A Reason for this condition's last transition from one status to another. type: string status: description: Status of this condition; is it currently True, False, or Unknown? type: string type: description: |- Type of this condition. At most one of each condition type may apply to a resource at any point in time. type: string required: - lastTransitionTime - reason - status - type type: object type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map observedGeneration: description: |- ObservedGeneration is the latest metadata.generation which resulted in either a ready state, or stalled due to error it can not recover from without human intervention. format: int64 type: integer type: object required: - spec type: object served: true storage: true subresources: status: {}