{
  "typeName" : "AWS::BedrockAgentCore::OAuth2CredentialProvider",
  "description" : "Resource Type definition for AWS::BedrockAgentCore::OAuth2CredentialProvider",
  "definitions" : {
    "Tag" : {
      "type" : "object",
      "properties" : {
        "Key" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 128,
          "pattern" : "^[a-zA-Z0-9\\s._:/=+@-]*$"
        },
        "Value" : {
          "type" : "string",
          "minLength" : 0,
          "maxLength" : 256,
          "pattern" : "^[a-zA-Z0-9\\s._:/=+@-]*$"
        }
      },
      "required" : [ "Key", "Value" ],
      "additionalProperties" : false
    },
    "Oauth2AuthorizationServerMetadata" : {
      "type" : "object",
      "description" : "Authorization server metadata for the OAuth2 provider",
      "properties" : {
        "Issuer" : {
          "type" : "string",
          "description" : "The issuer URL for the OAuth2 authorization server"
        },
        "AuthorizationEndpoint" : {
          "type" : "string",
          "description" : "The authorization endpoint URL"
        },
        "TokenEndpoint" : {
          "type" : "string",
          "description" : "The token endpoint URL"
        },
        "ResponseTypes" : {
          "type" : "array",
          "description" : "The supported response types",
          "items" : {
            "type" : "string"
          },
          "insertionOrder" : false
        }
      },
      "required" : [ "Issuer", "AuthorizationEndpoint", "TokenEndpoint" ],
      "additionalProperties" : false
    },
    "Oauth2Discovery" : {
      "type" : "object",
      "description" : "Discovery information for an OAuth2 provider",
      "properties" : {
        "DiscoveryUrl" : {
          "type" : "string",
          "description" : "The discovery URL for the OAuth2 provider",
          "pattern" : "^.+/\\.well-known/openid-configuration$"
        },
        "AuthorizationServerMetadata" : {
          "$ref" : "#/definitions/Oauth2AuthorizationServerMetadata"
        }
      },
      "additionalProperties" : false
    },
    "OnBehalfOfTokenExchangeConfig" : {
      "type" : "object",
      "description" : "Configuration for on-behalf-of token exchange",
      "properties" : {
        "GrantType" : {
          "type" : "string",
          "description" : "The grant type for on-behalf-of token exchange",
          "enum" : [ "TOKEN_EXCHANGE", "JWT_AUTHORIZATION_GRANT" ]
        },
        "TokenExchangeGrantTypeConfig" : {
          "$ref" : "#/definitions/TokenExchangeGrantTypeConfig"
        }
      },
      "required" : [ "GrantType" ],
      "additionalProperties" : false
    },
    "TokenExchangeGrantTypeConfig" : {
      "type" : "object",
      "description" : "Configuration for RFC 8693 Token Exchange",
      "properties" : {
        "ActorTokenContent" : {
          "type" : "string",
          "description" : "The actor token content type",
          "enum" : [ "NONE", "M2M", "AWS_IAM_ID_TOKEN_JWT" ]
        },
        "ActorTokenScopes" : {
          "type" : "array",
          "description" : "The actor token scopes. Only valid when ActorTokenContent is M2M.",
          "items" : {
            "type" : "string"
          },
          "insertionOrder" : false
        }
      },
      "required" : [ "ActorTokenContent" ],
      "additionalProperties" : false
    },
    "CustomOauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for a custom OAuth2 provider",
      "properties" : {
        "OauthDiscovery" : {
          "$ref" : "#/definitions/Oauth2Discovery"
        },
        "ClientId" : {
          "type" : "string",
          "description" : "The client ID for the custom OAuth2 provider",
          "minLength" : 1,
          "maxLength" : 256
        },
        "ClientSecret" : {
          "type" : "string",
          "description" : "The client secret for the custom OAuth2 provider",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "ClientSecretConfig" : {
          "$ref" : "#/definitions/SecretReference"
        },
        "ClientSecretSource" : {
          "type" : "string",
          "description" : "The source of the client secret",
          "enum" : [ "MANAGED", "EXTERNAL" ]
        },
        "OnBehalfOfTokenExchangeConfig" : {
          "$ref" : "#/definitions/OnBehalfOfTokenExchangeConfig"
        },
        "ClientAuthenticationMethod" : {
          "type" : "string",
          "description" : "The client authentication method to use when authenticating with the token endpoint",
          "enum" : [ "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT" ]
        }
      },
      "required" : [ "OauthDiscovery" ],
      "additionalProperties" : false
    },
    "GoogleOauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for a Google OAuth2 provider",
      "properties" : {
        "ClientId" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 256
        },
        "ClientSecret" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "ClientSecretConfig" : {
          "$ref" : "#/definitions/SecretReference"
        },
        "ClientSecretSource" : {
          "type" : "string",
          "enum" : [ "MANAGED", "EXTERNAL" ]
        }
      },
      "required" : [ "ClientId" ],
      "additionalProperties" : false
    },
    "GithubOauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for a GitHub OAuth2 provider",
      "properties" : {
        "ClientId" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 256
        },
        "ClientSecret" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "ClientSecretConfig" : {
          "$ref" : "#/definitions/SecretReference"
        },
        "ClientSecretSource" : {
          "type" : "string",
          "enum" : [ "MANAGED", "EXTERNAL" ]
        }
      },
      "required" : [ "ClientId" ],
      "additionalProperties" : false
    },
    "SlackOauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for a Slack OAuth2 provider",
      "properties" : {
        "ClientId" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 256
        },
        "ClientSecret" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "ClientSecretConfig" : {
          "$ref" : "#/definitions/SecretReference"
        },
        "ClientSecretSource" : {
          "type" : "string",
          "enum" : [ "MANAGED", "EXTERNAL" ]
        }
      },
      "required" : [ "ClientId" ],
      "additionalProperties" : false
    },
    "SalesforceOauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for a Salesforce OAuth2 provider",
      "properties" : {
        "ClientId" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 256
        },
        "ClientSecret" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "ClientSecretConfig" : {
          "$ref" : "#/definitions/SecretReference"
        },
        "ClientSecretSource" : {
          "type" : "string",
          "enum" : [ "MANAGED", "EXTERNAL" ]
        }
      },
      "required" : [ "ClientId" ],
      "additionalProperties" : false
    },
    "MicrosoftOauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for a Microsoft OAuth2 provider",
      "properties" : {
        "ClientId" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 256
        },
        "ClientSecret" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "ClientSecretConfig" : {
          "$ref" : "#/definitions/SecretReference"
        },
        "ClientSecretSource" : {
          "type" : "string",
          "enum" : [ "MANAGED", "EXTERNAL" ]
        },
        "TenantId" : {
          "type" : "string",
          "description" : "The Microsoft Entra ID tenant ID",
          "minLength" : 1,
          "maxLength" : 2048
        }
      },
      "required" : [ "ClientId" ],
      "additionalProperties" : false
    },
    "AtlassianOauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for an Atlassian OAuth2 provider",
      "properties" : {
        "ClientId" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 256
        },
        "ClientSecret" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "ClientSecretConfig" : {
          "$ref" : "#/definitions/SecretReference"
        },
        "ClientSecretSource" : {
          "type" : "string",
          "enum" : [ "MANAGED", "EXTERNAL" ]
        }
      },
      "required" : [ "ClientId" ],
      "additionalProperties" : false
    },
    "LinkedinOauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for a LinkedIn OAuth2 provider",
      "properties" : {
        "ClientId" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 256
        },
        "ClientSecret" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "ClientSecretConfig" : {
          "$ref" : "#/definitions/SecretReference"
        },
        "ClientSecretSource" : {
          "type" : "string",
          "enum" : [ "MANAGED", "EXTERNAL" ]
        }
      },
      "required" : [ "ClientId" ],
      "additionalProperties" : false
    },
    "IncludedOauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for a supported non-custom OAuth2 provider",
      "properties" : {
        "ClientId" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 256
        },
        "ClientSecret" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "ClientSecretConfig" : {
          "$ref" : "#/definitions/SecretReference"
        },
        "ClientSecretSource" : {
          "type" : "string",
          "enum" : [ "MANAGED", "EXTERNAL" ]
        },
        "Issuer" : {
          "type" : "string",
          "description" : "Token issuer of your isolated OAuth2 application tenant"
        },
        "AuthorizationEndpoint" : {
          "type" : "string",
          "description" : "OAuth2 authorization endpoint for your isolated OAuth2 application tenant"
        },
        "TokenEndpoint" : {
          "type" : "string",
          "description" : "OAuth2 token endpoint for your isolated OAuth2 application tenant"
        }
      },
      "required" : [ "ClientId" ],
      "additionalProperties" : false
    },
    "Oauth2ProviderConfigInput" : {
      "type" : "object",
      "description" : "Input configuration for an OAuth2 provider",
      "properties" : {
        "CustomOauth2ProviderConfig" : {
          "$ref" : "#/definitions/CustomOauth2ProviderConfigInput"
        },
        "GoogleOauth2ProviderConfig" : {
          "$ref" : "#/definitions/GoogleOauth2ProviderConfigInput"
        },
        "GithubOauth2ProviderConfig" : {
          "$ref" : "#/definitions/GithubOauth2ProviderConfigInput"
        },
        "SlackOauth2ProviderConfig" : {
          "$ref" : "#/definitions/SlackOauth2ProviderConfigInput"
        },
        "SalesforceOauth2ProviderConfig" : {
          "$ref" : "#/definitions/SalesforceOauth2ProviderConfigInput"
        },
        "MicrosoftOauth2ProviderConfig" : {
          "$ref" : "#/definitions/MicrosoftOauth2ProviderConfigInput"
        },
        "AtlassianOauth2ProviderConfig" : {
          "$ref" : "#/definitions/AtlassianOauth2ProviderConfigInput"
        },
        "LinkedinOauth2ProviderConfig" : {
          "$ref" : "#/definitions/LinkedinOauth2ProviderConfigInput"
        },
        "IncludedOauth2ProviderConfig" : {
          "$ref" : "#/definitions/IncludedOauth2ProviderConfigInput"
        }
      },
      "additionalProperties" : false
    },
    "Oauth2ProviderConfigOutput" : {
      "type" : "object",
      "description" : "Output configuration for an OAuth2 provider",
      "properties" : {
        "OauthDiscovery" : {
          "$ref" : "#/definitions/Oauth2Discovery"
        },
        "ClientId" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 256
        },
        "OnBehalfOfTokenExchangeConfig" : {
          "$ref" : "#/definitions/OnBehalfOfTokenExchangeConfig"
        },
        "ClientAuthenticationMethod" : {
          "type" : "string",
          "description" : "The client authentication method used when authenticating with the token endpoint",
          "enum" : [ "CLIENT_SECRET_BASIC", "CLIENT_SECRET_POST", "AWS_IAM_ID_TOKEN_JWT" ]
        }
      },
      "additionalProperties" : false
    },
    "ClientSecretArn" : {
      "type" : "object",
      "description" : "Contains information about a secret in AWS Secrets Manager",
      "properties" : {
        "SecretArn" : {
          "type" : "string",
          "description" : "The ARN of the secret in AWS Secrets Manager",
          "pattern" : "^arn:(aws|aws-us-gov):secretsmanager:[A-Za-z0-9-]{1,64}:[0-9]{12}:secret:[a-zA-Z0-9-_/+=.@!]+$"
        }
      },
      "required" : [ "SecretArn" ],
      "additionalProperties" : false
    },
    "SecretReference" : {
      "type" : "object",
      "description" : "A reference to a customer-provided secret stored in AWS Secrets Manager",
      "properties" : {
        "SecretId" : {
          "type" : "string",
          "description" : "The ID or ARN of the secret in AWS Secrets Manager",
          "minLength" : 1,
          "maxLength" : 2048
        },
        "JsonKey" : {
          "type" : "string",
          "description" : "The JSON key within the secret that contains the credential value",
          "minLength" : 1,
          "maxLength" : 128
        }
      },
      "required" : [ "SecretId", "JsonKey" ],
      "additionalProperties" : false
    }
  },
  "properties" : {
    "Name" : {
      "type" : "string",
      "description" : "The name of the OAuth2 credential provider",
      "minLength" : 1,
      "maxLength" : 128,
      "pattern" : "^[a-zA-Z0-9\\-_]+$"
    },
    "CredentialProviderVendor" : {
      "type" : "string",
      "description" : "The vendor of the OAuth2 credential provider",
      "enum" : [ "GoogleOauth2", "GithubOauth2", "SlackOauth2", "SalesforceOauth2", "MicrosoftOauth2", "CustomOauth2", "AtlassianOauth2", "LinkedinOauth2", "XOauth2", "OktaOauth2", "OneLoginOauth2", "PingOneOauth2", "FacebookOauth2", "YandexOauth2", "RedditOauth2", "ZoomOauth2", "TwitchOauth2", "SpotifyOauth2", "DropboxOauth2", "NotionOauth2", "HubspotOauth2", "CyberArkOauth2", "FusionAuthOauth2", "Auth0Oauth2", "CognitoOauth2" ]
    },
    "Oauth2ProviderConfigInput" : {
      "$ref" : "#/definitions/Oauth2ProviderConfigInput",
      "description" : "The configuration settings for the OAuth2 provider"
    },
    "CredentialProviderArn" : {
      "type" : "string",
      "description" : "The Amazon Resource Name (ARN) of the OAuth2 credential provider",
      "pattern" : "^arn:(aws|aws-us-gov):bedrock-agentcore:[A-Za-z0-9-]{1,64}:[0-9]{12}:token-vault/[a-zA-Z0-9-.]+/oauth2credentialprovider/[a-zA-Z0-9-]+$"
    },
    "ClientSecretArn" : {
      "$ref" : "#/definitions/ClientSecretArn",
      "description" : "The ARN of the client secret in AWS Secrets Manager"
    },
    "ClientSecretJsonKey" : {
      "type" : "string",
      "description" : "The JSON key within the secret that contains the client secret value",
      "minLength" : 1,
      "maxLength" : 128
    },
    "ClientSecretSource" : {
      "type" : "string",
      "description" : "The source of the client secret",
      "enum" : [ "MANAGED", "EXTERNAL" ]
    },
    "CallbackUrl" : {
      "type" : "string",
      "description" : "The callback URL for the OAuth2 authorization flow"
    },
    "Oauth2ProviderConfigOutput" : {
      "$ref" : "#/definitions/Oauth2ProviderConfigOutput",
      "description" : "The output configuration for the OAuth2 provider"
    },
    "CreatedTime" : {
      "type" : "string",
      "format" : "date-time",
      "description" : "The timestamp when the credential provider was created"
    },
    "LastUpdatedTime" : {
      "type" : "string",
      "format" : "date-time",
      "description" : "The timestamp when the credential provider was last updated"
    },
    "Tags" : {
      "type" : "array",
      "description" : "Tags to assign to the OAuth2 credential provider",
      "items" : {
        "$ref" : "#/definitions/Tag"
      },
      "maxItems" : 50,
      "insertionOrder" : false
    }
  },
  "additionalProperties" : false,
  "required" : [ "Name", "CredentialProviderVendor" ],
  "readOnlyProperties" : [ "/properties/CredentialProviderArn", "/properties/ClientSecretArn", "/properties/ClientSecretJsonKey", "/properties/ClientSecretSource", "/properties/CallbackUrl", "/properties/Oauth2ProviderConfigOutput", "/properties/CreatedTime", "/properties/LastUpdatedTime" ],
  "writeOnlyProperties" : [ "/properties/Oauth2ProviderConfigInput" ],
  "createOnlyProperties" : [ "/properties/Name", "/properties/CredentialProviderVendor" ],
  "primaryIdentifier" : [ "/properties/CredentialProviderArn" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "tagProperty" : "/properties/Tags",
    "cloudFormationSystemTags" : true,
    "permissions" : [ "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource", "bedrock-agentcore:ListTagsForResource" ]
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "bedrock-agentcore:CreateOauth2CredentialProvider", "bedrock-agentcore:GetOauth2CredentialProvider", "bedrock-agentcore:CreateTokenVault", "bedrock-agentcore:TagResource", "secretsmanager:CreateSecret", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ]
    },
    "read" : {
      "permissions" : [ "bedrock-agentcore:GetOauth2CredentialProvider", "bedrock-agentcore:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "bedrock-agentcore:UpdateOauth2CredentialProvider", "bedrock-agentcore:GetOauth2CredentialProvider", "bedrock-agentcore:TagResource", "bedrock-agentcore:UntagResource", "bedrock-agentcore:ListTagsForResource", "secretsmanager:PutSecretValue", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ]
    },
    "delete" : {
      "permissions" : [ "bedrock-agentcore:DeleteOauth2CredentialProvider", "bedrock-agentcore:GetOauth2CredentialProvider", "secretsmanager:DeleteSecret" ]
    },
    "list" : {
      "permissions" : [ "bedrock-agentcore:ListOauth2CredentialProviders" ]
    }
  }
}