IdentitySource

Source: src/AWS/VerifiedPermissions/IdentitySource.ts

An identity source connects a Verified Permissions policy store to an identity provider — an Amazon Cognito user pool or any OpenID Connect (OIDC) IdP — so that IsAuthorizedWithToken and BatchIsAuthorizedWithToken can derive the principal directly from a JWT.

Connecting an Identity Provider

Cognito User Pool

import * as AWS from "alchemy/AWS";

const store = yield* AWS.VerifiedPermissions.PolicyStore("Store", {});

yield* AWS.VerifiedPermissions.IdentitySource("Users", {
  policyStoreId: store.policyStoreId,
  principalEntityType: "PhotoApp::User",
  cognito: {
    userPoolArn: userPool.userPoolArn,
  },
});

OpenID Connect Provider

yield* AWS.VerifiedPermissions.IdentitySource("Oidc", {
  policyStoreId: store.policyStoreId,
  principalEntityType: "PhotoApp::User",
  openIdConnect: {
    issuer: "https://accounts.google.com",
    tokenSelection: {
      identityTokenOnly: { clientIds: ["my-oauth-client-id"] },
    },
  },
});