Network.AWS.CognitoIdentity

Amazon Cognito

Amazon Cognito is a web service that delivers scoped temporary credentials to mobile devices and other untrusted environments. Amazon Cognito uniquely identifies a device and supplies the user with a consistent identity over the lifetime of an application.

Using Amazon Cognito, you can enable authentication with one or more third-party identity providers (Facebook, Google, or Login with Amazon), and you can also choose to support unauthenticated access from your app. Cognito delivers a unique identifier for each user and acts as an OpenID token provider trusted by AWS Security Token Service (STS) to access temporary, limited-privilege AWS credentials.

To provide end-user credentials, first make an unsigned call to GetId. If the end user is authenticated with one of the supported identity providers, set the Logins map with the identity provider token. GetId returns a unique identifier for the user.

Next, make an unsigned call to GetCredentialsForIdentity. This call expects the same Logins map as the GetId call, as well as the IdentityID originally returned by GetId. Assuming your identity pool has been configured via the SetIdentityPoolRoles operation, GetCredentialsForIdentity will return AWS credentials for your use. If your pool has not been configured with SetIdentityPoolRoles, or if you want to follow legacy flow, make an unsigned call to GetOpenIdToken, which returns the OpenID token necessary to call STS and retrieve AWS credentials. This call expects the same Logins map as the GetId call, as well as the IdentityID originally returned by GetId. The token returned by GetOpenIdToken can be passed to the STS operation AssumeRoleWithWebIdentity to retrieve AWS credentials.

If you want to use Amazon Cognito in an Android, iOS, or Unity application, you will probably want to make API calls via the AWS Mobile SDK. To learn more, see the AWS Mobile SDK Developer Guide.

See: AWS API Reference

Service Configuration

cognitoIdentity :: Service

API version '2014-06-30' of the Amazon Cognito Identity SDK configuration.

Errors

Error matchers are designed for use with the functions provided by Control.Exception.Lens. This allows catching (and rethrowing) service specific errors returned by CognitoIdentity.

InvalidIdentityPoolConfigurationException

_InvalidIdentityPoolConfigurationException :: AsError a => Getting (First ServiceError) a ServiceError

Thrown if the identity pool has no role associated for the given auth type (auth/unauth) or if the AssumeRole fails.

InvalidParameterException

_InvalidParameterException :: AsError a => Getting (First ServiceError) a ServiceError

Thrown for missing or bad input parameter(s).

NotAuthorizedException

_NotAuthorizedException :: AsError a => Getting (First ServiceError) a ServiceError

Thrown when a user is not authorized to access the requested resource.

InternalErrorException

_InternalErrorException :: AsError a => Getting (First ServiceError) a ServiceError

Thrown when the service encounters an error during processing the request.

ExternalServiceException

_ExternalServiceException :: AsError a => Getting (First ServiceError) a ServiceError

An exception thrown when a dependent service such as Facebook or Twitter is not responding

ConcurrentModificationException

_ConcurrentModificationException :: AsError a => Getting (First ServiceError) a ServiceError

Thrown if there are parallel requests to modify a resource.

TooManyRequestsException

_TooManyRequestsException :: AsError a => Getting (First ServiceError) a ServiceError

Thrown when a request is throttled.

ResourceConflictException

_ResourceConflictException :: AsError a => Getting (First ServiceError) a ServiceError

Thrown when a user tries to use a login which is already linked to another account.

DeveloperUserAlreadyRegisteredException

_DeveloperUserAlreadyRegisteredException :: AsError a => Getting (First ServiceError) a ServiceError

The provided developer user identifier is already registered with Cognito under a different identity ID.

ResourceNotFoundException

_ResourceNotFoundException :: AsError a => Getting (First ServiceError) a ServiceError

Thrown when the requested resource (for example, a dataset or record) does not exist.

LimitExceededException

_LimitExceededException :: AsError a => Getting (First ServiceError) a ServiceError

Thrown when the total number of user pools has exceeded a preset limit.

Waiters

Waiters poll by repeatedly sending a request until some remote success condition configured by the Wait specification is fulfilled. The Wait specification determines how many attempts should be made, in addition to delay and retry strategies.

Operations

Some AWS operations return results that are incomplete and require subsequent requests in order to obtain the entire result set. The process of sending subsequent requests to continue where a previous request left off is called pagination. For example, the ListObjects operation of Amazon S3 returns up to 1000 objects at a time, and you must send subsequent requests with the appropriate Marker in order to retrieve the next page of results.

Operations that have an AWSPager instance can transparently perform subsequent requests, correctly setting Markers and other request facets to iterate through the entire result set of a truncated API operation. Operations which support this have an additional note in the documentation.

Many operations have the ability to filter results on the server side. See the individual operation parameters for details.

GetOpenIdToken

module Network.AWS.CognitoIdentity.GetOpenIdToken

DescribeIdentityPool

module Network.AWS.CognitoIdentity.DescribeIdentityPool

GetOpenIdTokenForDeveloperIdentity

module Network.AWS.CognitoIdentity.GetOpenIdTokenForDeveloperIdentity

UnlinkDeveloperIdentity

module Network.AWS.CognitoIdentity.UnlinkDeveloperIdentity

GetCredentialsForIdentity

module Network.AWS.CognitoIdentity.GetCredentialsForIdentity

ListIdentityPools

module Network.AWS.CognitoIdentity.ListIdentityPools

GetIdentityPoolRoles

module Network.AWS.CognitoIdentity.GetIdentityPoolRoles

DeleteIdentityPool

module Network.AWS.CognitoIdentity.DeleteIdentityPool

UpdateIdentityPool

module Network.AWS.CognitoIdentity.UpdateIdentityPool

GetId

module Network.AWS.CognitoIdentity.GetId

DeleteIdentities

module Network.AWS.CognitoIdentity.DeleteIdentities

SetIdentityPoolRoles

module Network.AWS.CognitoIdentity.SetIdentityPoolRoles

ListIdentities

module Network.AWS.CognitoIdentity.ListIdentities

LookupDeveloperIdentity

module Network.AWS.CognitoIdentity.LookupDeveloperIdentity

UnlinkIdentity

module Network.AWS.CognitoIdentity.UnlinkIdentity

DescribeIdentity

module Network.AWS.CognitoIdentity.DescribeIdentity

CreateIdentityPool

module Network.AWS.CognitoIdentity.CreateIdentityPool

MergeDeveloperIdentities

module Network.AWS.CognitoIdentity.MergeDeveloperIdentities

Types

CognitoErrorCode

data CognitoErrorCode

Constructors

AccessDenied

InternalServerError

Instances

Enum CognitoErrorCode

Eq CognitoErrorCode

Data CognitoErrorCode

Ord CognitoErrorCode

Read CognitoErrorCode

Show CognitoErrorCode

Generic CognitoErrorCode

FromJSON CognitoErrorCode

Hashable CognitoErrorCode

ToHeader CognitoErrorCode

ToQuery CognitoErrorCode

ToByteString CognitoErrorCode

FromText CognitoErrorCode

ToText CognitoErrorCode

Typeable * CognitoErrorCode

type Rep CognitoErrorCode

Credentials

data Credentials

Credentials for the the provided identity ID.

See: credentials smart constructor.

Instances

Eq Credentials

Data Credentials

Read Credentials

Show Credentials

Generic Credentials

FromJSON Credentials

Typeable * Credentials

type Rep Credentials

credentials :: Credentials

Creates a value of Credentials with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• cSessionToken
• cExpiration
• cSecretKey
• cAccessKeyId

cSessionToken :: Lens' Credentials (Maybe Text)

The Session Token portion of the credentials

cExpiration :: Lens' Credentials (Maybe UTCTime)

The date at which these credentials will expire.

cSecretKey :: Lens' Credentials (Maybe Text)

The Secret Access Key portion of the credentials

cAccessKeyId :: Lens' Credentials (Maybe Text)

The Access Key portion of the credentials.

IdentityDescription

data IdentityDescription

A description of the identity.

See: identityDescription smart constructor.

Instances

Eq IdentityDescription

Data IdentityDescription

Read IdentityDescription

Show IdentityDescription

Generic IdentityDescription

FromJSON IdentityDescription

Typeable * IdentityDescription

type Rep IdentityDescription

identityDescription :: IdentityDescription

Creates a value of IdentityDescription with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• idLastModifiedDate
• idCreationDate
• idLogins
• idIdentityId

idLastModifiedDate :: Lens' IdentityDescription (Maybe UTCTime)

Date on which the identity was last modified.

idCreationDate :: Lens' IdentityDescription (Maybe UTCTime)

Date on which the identity was created.

idLogins :: Lens' IdentityDescription [Text]

A set of optional name-value pairs that map provider names to provider tokens.

idIdentityId :: Lens' IdentityDescription (Maybe Text)

A unique identifier in the format REGION:GUID.

IdentityPool

data IdentityPool

An object representing a Cognito identity pool.

See: identityPool smart constructor.

Instances

Eq IdentityPool

Data IdentityPool

Read IdentityPool

Show IdentityPool

Generic IdentityPool

ToJSON IdentityPool

FromJSON IdentityPool

Typeable * IdentityPool

type Rep IdentityPool

identityPool

Arguments

:: Text

ipIdentityPoolId

-> Text

ipIdentityPoolName

-> Bool

ipAllowUnauthenticatedIdentities

-> IdentityPool

Creates a value of IdentityPool with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• ipSupportedLoginProviders
• ipDeveloperProviderName
• ipOpenIdConnectProviderARNs
• ipIdentityPoolId
• ipIdentityPoolName
• ipAllowUnauthenticatedIdentities

ipSupportedLoginProviders :: Lens' IdentityPool (HashMap Text Text)

Optional key:value pairs mapping provider names to provider app IDs.

ipDeveloperProviderName :: Lens' IdentityPool (Maybe Text)

The "domain" by which Cognito will refer to your users.

ipOpenIdConnectProviderARNs :: Lens' IdentityPool [Text]

A list of OpendID Connect provider ARNs.

ipIdentityPoolId :: Lens' IdentityPool Text

An identity pool ID in the format REGION:GUID.

ipIdentityPoolName :: Lens' IdentityPool Text

A string that you provide.

ipAllowUnauthenticatedIdentities :: Lens' IdentityPool Bool

TRUE if the identity pool supports unauthenticated logins.

IdentityPoolShortDescription

data IdentityPoolShortDescription

A description of the identity pool.

See: identityPoolShortDescription smart constructor.

Instances

Eq IdentityPoolShortDescription

Data IdentityPoolShortDescription

Read IdentityPoolShortDescription

Show IdentityPoolShortDescription

Generic IdentityPoolShortDescription

FromJSON IdentityPoolShortDescription

Typeable * IdentityPoolShortDescription

type Rep IdentityPoolShortDescription

identityPoolShortDescription :: IdentityPoolShortDescription

Creates a value of IdentityPoolShortDescription with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• ipsdIdentityPoolId
• ipsdIdentityPoolName

ipsdIdentityPoolId :: Lens' IdentityPoolShortDescription (Maybe Text)

An identity pool ID in the format REGION:GUID.

ipsdIdentityPoolName :: Lens' IdentityPoolShortDescription (Maybe Text)

A string that you provide.

UnprocessedIdentityId

data UnprocessedIdentityId

An array of UnprocessedIdentityId objects, each of which contains an ErrorCode and IdentityId.

See: unprocessedIdentityId smart constructor.

Instances

Eq UnprocessedIdentityId

Data UnprocessedIdentityId

Read UnprocessedIdentityId

Show UnprocessedIdentityId

Generic UnprocessedIdentityId

FromJSON UnprocessedIdentityId

Typeable * UnprocessedIdentityId

type Rep UnprocessedIdentityId

unprocessedIdentityId :: UnprocessedIdentityId

Creates a value of UnprocessedIdentityId with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• uiiErrorCode
• uiiIdentityId

uiiErrorCode :: Lens' UnprocessedIdentityId (Maybe CognitoErrorCode)

The error code indicating the type of error that occurred.

uiiIdentityId :: Lens' UnprocessedIdentityId (Maybe Text)

A unique identifier in the format REGION:GUID.