aws-cdk-lib.aws_cognito.OAuthScope

OAuthScope Class

OAuth scopes that are allowed with this client.

Source

aws-cognito/lib/user-pool-client.ts

Example

const pool = new cognito.UserPool(this, 'Pool');

const readOnlyScope = new cognito.ResourceServerScope({ scopeName: 'read', scopeDescription: 'Read-only access' });
const fullAccessScope = new cognito.ResourceServerScope({ scopeName: '*', scopeDescription: 'Full access' });

const userServer = pool.addResourceServer('ResourceServer', {
  identifier: 'users',
  scopes: [ readOnlyScope, fullAccessScope ],
});

const readOnlyClient = pool.addClient('read-only-client', {
  // ...
  oAuth: {
    // ...
    scopes: [ cognito.OAuthScope.resourceServer(userServer, readOnlyScope) ],
  },
});

const fullAccessClient = pool.addClient('full-access-client', {
  // ...
  oAuth: {
    // ...
    scopes: [ cognito.OAuthScope.resourceServer(userServer, fullAccessScope) ],
  },
});

Properties

COGNITO_ADMINOAuthScopecognito_adminOAuthScopeCOGNITO_ADMINOAuthScopeCOGNITO_ADMINOAuthScopeCOGNITO_ADMINOAuthScoperequiredstatic#

Grants access to Amazon Cognito User Pool API operations that require access tokens, such as UpdateUserAttributes and VerifyUserAttribute.

EMAILOAuthScopeemailOAuthScopeEMAILOAuthScopeEMAILOAuthScopeEMAILOAuthScoperequiredstatic#

Grants access to the 'email' and 'email_verified' claims.

Automatically includes access to OAuthScope.OPENID.

OPENIDOAuthScopeopenidOAuthScopeOPENIDOAuthScopeOPENIDOAuthScopeOPENIDOAuthScoperequiredstatic#

Returns all user attributes in the ID token that are readable by the client.

PHONEOAuthScopephoneOAuthScopePHONEOAuthScopePHONEOAuthScopePHONEOAuthScoperequiredstatic#

Grants access to the 'phone_number' and 'phone_number_verified' claims.

Automatically includes access to OAuthScope.OPENID.

PROFILEOAuthScopeprofileOAuthScopePROFILEOAuthScopePROFILEOAuthScopePROFILEOAuthScoperequiredstatic#

Grants access to all user attributes that are readable by the client Automatically includes access to `OAuthScope.OPENID`.

scopeNamestringscope_namestrscopeNameStringScopeNamestringScopeName*stringrequired#

The name of this scope as recognized by CloudFormation.

Methods

custom(name: string): OAuthScope // chainable@staticmethod def custom(name: str) -> OAuthScopepublic static OAuthScope custom(String name)public static OAuthScope Custom(string name)func Custom(Name *string) OAuthScopestatic#

Custom scope is one that you define for your own resource server in the Resource Servers.

The format is 'resource-server-identifier/scope'.

resourceServer(server: IUserPoolResourceServer, scope: ResourceServerScope): OAuthScope // chainable@staticmethod def resource_server(server: IUserPoolResourceServer, scope: ResourceServerScope) -> OAuthScopepublic static OAuthScope resourceServer(IUserPoolResourceServer server, ResourceServerScope scope)public static OAuthScope ResourceServer(IUserPoolResourceServer server, ResourceServerScope scope)func ResourceServer(Server IUserPoolResourceServer, Scope ResourceServerScope) OAuthScopestatic#

Adds a custom scope that's tied to a resource server in your stack.