get_identity_pool_roles

get_identity_pool_roles(**kwargs)

Gets the roles for an identity pool.

You must use AWS Developer credentials to call this API.

See also: AWS API Documentation

Request Syntax

response = client.get_identity_pool_roles(
    IdentityPoolId='string'
)

Parameters

IdentityPoolId (string) --

[REQUIRED]

An identity pool ID in the format REGION:GUID.

Return type

dict

Returns

Response Syntax

{
    'IdentityPoolId': 'string',
    'Roles': {
        'string': 'string'
    },
    'RoleMappings': {
        'string': {
            'Type': 'Token'|'Rules',
            'AmbiguousRoleResolution': 'AuthenticatedRole'|'Deny',
            'RulesConfiguration': {
                'Rules': [
                    {
                        'Claim': 'string',
                        'MatchType': 'Equals'|'Contains'|'StartsWith'|'NotEqual',
                        'Value': 'string',
                        'RoleARN': 'string'
                    },
                ]
            }
        }
    }
}

Response Structure

• (dict) --

  Returned in response to a successful GetIdentityPoolRoles operation.

  • IdentityPoolId (string) --

    An identity pool ID in the format REGION:GUID.

  • Roles (dict) --

    The map of roles associated with this pool. Currently only authenticated and unauthenticated roles are supported.

    • (string) --
      • (string) --
  • RoleMappings (dict) --

    How users for a specific identity provider are to mapped to roles. This is a String-to- RoleMapping object map. The string identifies the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id".

    • (string) --
      • (dict) --

        A role mapping.

        • Type (string) --

          The role mapping type. Token will use cognito:roles and cognito:preferred_role claims from the Cognito identity provider token to map groups to roles. Rules will attempt to match claims from the token to map to a role.

        • AmbiguousRoleResolution (string) --

          If you specify Token or Rules as the Type , AmbiguousRoleResolution is required.

          Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type.

        • RulesConfiguration (dict) --

          The rules to be used for mapping users to roles.

          If you specify Rules as the role mapping type, RulesConfiguration is required.

          • Rules (list) --

            An array of rules. You can specify up to 25 rules per identity provider.

            Rules are evaluated in order. The first one to match specifies the role.

            • (dict) --

              A rule that maps a claim name, a claim value, and a match type to a role ARN.

              • Claim (string) --

                The claim name that must be present in the token, for example, "isAdmin" or "paid".

              • MatchType (string) --

                The match condition that specifies how closely the claim value in the IdP token must match Value .

              • Value (string) --

                A brief string that the claim must match, for example, "paid" or "yes".

              • RoleARN (string) --

                The role ARN.

Exceptions

• CognitoIdentity.Client.exceptions.InvalidParameterException
• CognitoIdentity.Client.exceptions.ResourceNotFoundException
• CognitoIdentity.Client.exceptions.NotAuthorizedException
• CognitoIdentity.Client.exceptions.ResourceConflictException
• CognitoIdentity.Client.exceptions.TooManyRequestsException
• CognitoIdentity.Client.exceptions.InternalErrorException