{
  "typeName" : "AWS::EMR::StudioSessionMapping",
  "description" : "An example resource schema demonstrating some basic constructs and validation rules.",
  "documentationUrl" : "https://docs.aws.amazon.com/cli/latest/reference/emr/create-studio-session-mapping.html",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
  "definitions" : {
    "IamPolicyArn" : {
      "type" : "string",
      "pattern" : "^arn:aws(-(cn|us-gov|iso-f|iso-e))?:iam::([0-9]{12})?:policy\\/[^.]+$"
    }
  },
  "properties" : {
    "IdentityName" : {
      "type" : "string",
      "description" : "The name of the user or group. For more information, see UserName and DisplayName in the AWS SSO Identity Store API Reference. Either IdentityName or IdentityId must be specified."
    },
    "IdentityType" : {
      "type" : "string",
      "description" : "Specifies whether the identity to map to the Studio is a user or a group.",
      "enum" : [ "USER", "GROUP" ]
    },
    "SessionPolicyArn" : {
      "description" : "The Amazon Resource Name (ARN) for the session policy that will be applied to the user or group. Session policies refine Studio user permissions without the need to use multiple IAM user roles.",
      "$ref" : "#/definitions/IamPolicyArn"
    },
    "StudioId" : {
      "description" : "The ID of the Amazon EMR Studio to which the user or group will be mapped.",
      "type" : "string",
      "pattern" : "^es-[0-9A-Z]+",
      "minLength" : 4,
      "maxLength" : 256
    }
  },
  "additionalProperties" : false,
  "required" : [ "StudioId", "IdentityName", "IdentityType", "SessionPolicyArn" ],
  "createOnlyProperties" : [ "/properties/StudioId", "/properties/IdentityType", "/properties/IdentityName" ],
  "primaryIdentifier" : [ "/properties/StudioId", "/properties/IdentityType", "/properties/IdentityName" ],
  "tagging" : {
    "taggable" : false,
    "tagOnCreate" : false,
    "tagUpdatable" : false,
    "cloudFormationSystemTags" : false
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "elasticmapreduce:CreateStudioSessionMapping", "sso-directory:SearchUsers", "sso-directory:SearchGroups", "sso-directory:DescribeUser", "sso-directory:DescribeGroup", "sso:GetManagedApplicationInstance", "sso:ListDirectoryAssociations", "sso:GetProfile", "sso:ListProfiles", "sso:AssociateProfile", "sso:CreateApplication", "sso:PutApplicationAuthenticationMethod", "sso:PutApplicationGrant", "sso:PutApplicationAccessScope", "sso:PutApplicationAssignmentConfiguration", "sso:DescribeApplication", "sso:DeleteApplication", "sso:DeleteApplicationAuthenticationMethod", "sso:DeleteApplicationAccessScope", "sso:DeleteApplicationGrant", "sso:ListInstances", "sso-directory:CreateUser", "sso-directory:CreateGroup", "sso:CreateApplicationAssignment", "sso:DescribeInstance", "sso:DeleteApplicationAssignment", "sso:ListApplicationAssignments" ]
    },
    "read" : {
      "permissions" : [ "elasticmapreduce:GetStudioSessionMapping", "sso-directory:SearchUsers", "sso-directory:SearchGroups", "sso-directory:DescribeUser", "sso-directory:DescribeGroup", "sso:GetManagedApplicationInstance", "sso:DescribeInstance" ]
    },
    "update" : {
      "permissions" : [ "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:UpdateStudioSessionMapping", "sso-directory:SearchUsers", "sso-directory:SearchGroups", "sso-directory:DescribeUser", "sso-directory:DescribeGroup", "sso:GetManagedApplicationInstance", "sso:DescribeInstance" ]
    },
    "delete" : {
      "permissions" : [ "elasticmapreduce:GetStudioSessionMapping", "elasticmapreduce:DeleteStudioSessionMapping", "sso-directory:SearchUsers", "sso-directory:SearchGroups", "sso-directory:DescribeUser", "sso-directory:DescribeGroup", "sso:GetManagedApplicationInstance", "sso:DescribeInstance", "sso:ListDirectoryAssociations", "sso:GetProfile", "sso:ListProfiles", "sso:DisassociateProfile" ]
    },
    "list" : {
      "permissions" : [ "elasticmapreduce:ListStudioSessionMappings" ]
    }
  }
}