{
  "typeName" : "AWS::OpenSearchServerless::SecurityConfig",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-opensearchserverless",
  "description" : "Amazon OpenSearchServerless security config resource",
  "tagging" : {
    "taggable" : false,
    "tagOnCreate" : false,
    "tagUpdatable" : false,
    "cloudFormationSystemTags" : false
  },
  "definitions" : {
    "SamlConfigOptions" : {
      "type" : "object",
      "description" : "Describes saml options in form of key value map",
      "properties" : {
        "Metadata" : {
          "type" : "string",
          "description" : "The XML saml provider metadata document that you want to use",
          "maxLength" : 51200,
          "minLength" : 1,
          "pattern" : "[\\u0009\\u000A\\u000D\\u0020-\\u007E\\u00A1-\\u00FF]+"
        },
        "UserAttribute" : {
          "type" : "string",
          "description" : "Custom attribute for this saml integration",
          "maxLength" : 2048,
          "minLength" : 1,
          "pattern" : "[\\w+=,.@-]+"
        },
        "GroupAttribute" : {
          "type" : "string",
          "description" : "Group attribute for this saml integration",
          "maxLength" : 2048,
          "minLength" : 1,
          "pattern" : "[\\w+=,.@-]+"
        },
        "OpenSearchServerlessEntityId" : {
          "type" : "string",
          "description" : "Custom entity id attribute to override default entity id for this saml integration",
          "maxLength" : 1024,
          "minLength" : 1,
          "pattern" : "^aws:opensearch:[0-9]{12}:*"
        },
        "SessionTimeout" : {
          "type" : "integer",
          "description" : "Defines the session timeout in minutes"
        }
      },
      "required" : [ "Metadata" ],
      "additionalProperties" : false
    },
    "SecurityConfigType" : {
      "type" : "string",
      "description" : "Config type for security config",
      "enum" : [ "saml", "iamidentitycenter", "iamfederation" ]
    },
    "IamIdentityCenterInstanceArn" : {
      "type" : "string",
      "description" : "The ARN of the IAM Identity Center instance used to integrate with OpenSearch Serverless"
    },
    "IamIdentityCenterApplicationArn" : {
      "type" : "string",
      "description" : "The ARN of the IAM Identity Center application used to integrate with OpenSearch Serverless"
    },
    "IamIdentityCenterUserAttribute" : {
      "type" : "string",
      "description" : "User attribute for this IAM Identity Center integration"
    },
    "IamIdentityCenterGroupAttribute" : {
      "type" : "string",
      "description" : "Group attribute for this IAM Identity Center integration"
    },
    "IamIdentityCenterConfigOptions" : {
      "type" : "object",
      "description" : "Describes IAM Identity Center options for an OpenSearch Serverless security configuration in the form of a key-value map",
      "properties" : {
        "InstanceArn" : {
          "$ref" : "#/definitions/IamIdentityCenterInstanceArn"
        },
        "ApplicationArn" : {
          "$ref" : "#/definitions/IamIdentityCenterApplicationArn"
        },
        "ApplicationName" : {
          "type" : "string",
          "description" : "The name of the IAM Identity Center application used to integrate with OpenSearch Serverless"
        },
        "ApplicationDescription" : {
          "type" : "string",
          "description" : "The description of the IAM Identity Center application used to integrate with OpenSearch Serverless"
        },
        "UserAttribute" : {
          "$ref" : "#/definitions/IamIdentityCenterUserAttribute"
        },
        "GroupAttribute" : {
          "$ref" : "#/definitions/IamIdentityCenterGroupAttribute"
        }
      },
      "required" : [ "InstanceArn" ],
      "additionalProperties" : false
    },
    "IamFederationConfigOptions" : {
      "type" : "object",
      "description" : "Describe IAM federation options in form of key value map",
      "properties" : {
        "GroupAttribute" : {
          "type" : "string",
          "description" : "Group attribute for this IAM federation integration"
        },
        "UserAttribute" : {
          "type" : "string",
          "description" : "User attribute for this IAM federation integration"
        }
      },
      "additionalProperties" : false
    }
  },
  "properties" : {
    "Description" : {
      "type" : "string",
      "maxLength" : 1000,
      "minLength" : 1,
      "description" : "Security config description"
    },
    "Id" : {
      "type" : "string",
      "maxLength" : 100,
      "minLength" : 1,
      "description" : "The identifier of the security config"
    },
    "Name" : {
      "type" : "string",
      "maxLength" : 32,
      "minLength" : 3,
      "pattern" : "^[a-z][a-z0-9-]{2,31}$",
      "description" : "The friendly name of the security config"
    },
    "SamlOptions" : {
      "$ref" : "#/definitions/SamlConfigOptions"
    },
    "IamIdentityCenterOptions" : {
      "$ref" : "#/definitions/IamIdentityCenterConfigOptions"
    },
    "IamFederationOptions" : {
      "$ref" : "#/definitions/IamFederationConfigOptions"
    },
    "Type" : {
      "$ref" : "#/definitions/SecurityConfigType"
    }
  },
  "readOnlyProperties" : [ "/properties/Id", "/properties/IamIdentityCenterOptions/ApplicationArn", "/properties/IamIdentityCenterOptions/ApplicationName", "/properties/IamIdentityCenterOptions/ApplicationDescription" ],
  "writeOnlyProperties" : [ "/properties/Name" ],
  "createOnlyProperties" : [ "/properties/Type", "/properties/Name", "/properties/IamIdentityCenterOptions/InstanceArn" ],
  "primaryIdentifier" : [ "/properties/Id" ],
  "additionalIdentifiers" : [ [ "/properties/Name" ] ],
  "handlers" : {
    "create" : {
      "permissions" : [ "aoss:CreateSecurityConfig", "sso:CreateApplication", "sso:ListApplications", "sso:DeleteApplication", "sso:PutApplicationAssignmentConfiguration", "sso:PutApplicationAuthenticationMethod", "sso:PutApplicationGrant" ]
    },
    "read" : {
      "permissions" : [ "aoss:GetSecurityConfig" ]
    },
    "update" : {
      "permissions" : [ "aoss:GetSecurityConfig", "aoss:UpdateSecurityConfig" ]
    },
    "delete" : {
      "permissions" : [ "aoss:DeleteSecurityConfig", "sso:ListApplicationAssignments", "sso:DeleteApplicationAssignment", "sso:DeleteApplication" ]
    },
    "list" : {
      "handlerSchema" : {
        "properties" : {
          "Type" : {
            "$ref" : "resource-schema.json#/properties/Type"
          }
        },
        "required" : [ "Type" ]
      },
      "permissions" : [ "aoss:ListSecurityConfigs" ]
    }
  },
  "additionalProperties" : false
}