Skip to content
AWS for Query.Farm

aws.verifiedpermissions.get_identity_source

Example SQL Queries

SELECT * FROM
aws.verifiedpermissions.get_identity_source
WHERE
"policy_store_id" = 'VALUE'
AND "identity_source_id" = 'VALUE';

Description

Retrieves the details about the specified identity source.

Table Definition

Column NameColumn Data Type
identity_source_id Required Input Column

The ID of the identity source.

VARCHAR
policy_store_id Required Input Column

The ID of the policy store that contains the identity source.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
configuration

Contains configuration information about an identity source.

STRUCT(
    "cognito_user_pool_configuration" STRUCT(
        "user_pool_arn" VARCHAR,
        "client_ids" VARCHAR[],
        "issuer" VARCHAR,
        "group_configuration" STRUCT(
            "group_entity_type" VARCHAR
        )
    ),
    "open_id_connect_configuration" STRUCT(
        "issuer" VARCHAR,
        "entity_id_prefix" VARCHAR,
        "group_configuration" STRUCT(
            "group_claim" VARCHAR,
            "group_entity_type" VARCHAR
        ),
        "token_selection" STRUCT(
            "access_token_only" STRUCT(
                "principal_id_claim" VARCHAR,
                "audiences" VARCHAR[]
            ),
            "identity_token_only" STRUCT(
                "principal_id_claim" VARCHAR,
                "client_ids" VARCHAR[]
            )
        )
    )
)
Show child fields
configuration.cognito_user_pool_configuration

Contains configuration details of a Amazon Cognito user pool that Verified Permissions can use as a source of authenticated identities as entities. It specifies the Amazon Resource Name (ARN) of a Amazon Cognito user pool, the policy store entity that you want to assign to user groups, and one or more application client IDs.

Example: "configuration":{"cognitoUserPoolConfiguration":{"userPoolArn":"arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_1a2b3c4d5","clientIds": ["a1b2c3d4e5f6g7h8i9j0kalbmc"],"groupConfiguration": {"groupEntityType": "MyCorp::Group"}}}

Show child fields
configuration.cognito_user_pool_configuration.client_ids[]
configuration.cognito_user_pool_configuration.group_configuration

The type of entity that a policy store maps to groups from an Amazon Cognito user pool identity source.

Show child fields
configuration.cognito_user_pool_configuration.group_configuration.group_entity_type

The name of the schema entity type that's mapped to the user pool group. Defaults to AWS::CognitoGroup.

configuration.cognito_user_pool_configuration.issuer

The OpenID Connect (OIDC) issuer ID of the Amazon Cognito user pool that contains the identities to be authorized.

Example: "issuer": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_1a2b3c4d5"

configuration.cognito_user_pool_configuration.user_pool_arn

The Amazon Resource Name (ARN) of the Amazon Cognito user pool that contains the identities to be authorized.

Example: "userPoolArn": "arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_1a2b3c4d5"

configuration.open_id_connect_configuration

Contains configuration details of an OpenID Connect (OIDC) identity provider, or identity source, that Verified Permissions can use to generate entities from authenticated identities. It specifies the issuer URL, token type that you want to use, and policy store entity details.

Example:"configuration":{"openIdConnectConfiguration":{"issuer":"https://auth.example.com","tokenSelection":{"accessTokenOnly":{"audiences":["https://myapp.example.com","https://myapp2.example.com"],"principalIdClaim":"sub"}},"entityIdPrefix":"MyOIDCProvider","groupConfiguration":{"groupClaim":"groups","groupEntityType":"MyCorp::UserGroup"}}}

Show child fields
configuration.open_id_connect_configuration.entity_id_prefix

A descriptive string that you want to prefix to user entities from your OIDC identity provider. For example, if you set an entityIdPrefix of MyOIDCProvider, you can reference principals in your policies in the format MyCorp::User::MyOIDCProvider|Carlos.

configuration.open_id_connect_configuration.group_configuration

The claim in OIDC identity provider tokens that indicates a user's group membership, and the entity type that you want to map it to. For example, this object can map the contents of a groups claim to MyCorp::UserGroup.

Show child fields
configuration.open_id_connect_configuration.group_configuration.group_claim

The token claim that you want Verified Permissions to interpret as group membership. For example, groups.

configuration.open_id_connect_configuration.group_configuration.group_entity_type

The policy store entity type that you want to map your users' group claim to. For example, MyCorp::UserGroup. A group entity type is an entity that can have a user entity type as a member.

configuration.open_id_connect_configuration.issuer

The issuer URL of an OIDC identity provider. This URL must have an OIDC discovery endpoint at the path .well-known/openid-configuration.

configuration.open_id_connect_configuration.token_selection

The token type that you want to process from your OIDC identity provider. Your policy store can process either identity (ID) or access tokens from a given OIDC identity source.

Show child fields
configuration.open_id_connect_configuration.token_selection.access_token_only

The OIDC configuration for processing access tokens. Contains allowed audience claims, for example https://auth.example.com, and the claim that you want to map to the principal, for example sub.

Show child fields
configuration.open_id_connect_configuration.token_selection.access_token_only.audiences[]
configuration.open_id_connect_configuration.token_selection.access_token_only.principal_id_claim

The claim that determines the principal in OIDC access tokens. For example, sub.

configuration.open_id_connect_configuration.token_selection.identity_token_only

The OIDC configuration for processing identity (ID) tokens. Contains allowed client ID claims, for example 1example23456789, and the claim that you want to map to the principal, for example sub.

Show child fields
configuration.open_id_connect_configuration.token_selection.identity_token_only.client_ids[]
configuration.open_id_connect_configuration.token_selection.identity_token_only.principal_id_claim

The claim that determines the principal in OIDC access tokens. For example, sub.

created_date

The date and time that the identity source was originally created.

TIMESTAMP_S
details

A structure that describes the configuration of the identity source.

STRUCT(
    "client_ids" VARCHAR[],
    "user_pool_arn" VARCHAR,
    "discovery_url" VARCHAR,
    "open_id_issuer" VARCHAR
)
Show child fields
details.client_ids[]
details.discovery_url

The well-known URL that points to this user pool's OIDC discovery endpoint. This is a URL string in the following format. This URL replaces the placeholders for both the Amazon Web Services Region and the user pool identifier with those appropriate for this user pool.

https://cognito-idp.<region>.amazonaws.com/<user-pool-id>/.well-known/openid-configuration

details.open_id_issuer

A string that identifies the type of OIDC service represented by this identity source.

At this time, the only valid value is cognito.

details.user_pool_arn

The Amazon Resource Name (ARN) of the Amazon Cognito user pool whose identities are accessible to this Verified Permissions policy store.

last_updated_date

The date and time that the identity source was most recently updated.

TIMESTAMP_S
principal_entity_type

The data type of principals generated for identities authenticated by this identity source.

VARCHAR