Amazon Connection Properties

The following properties are available for Amazon Connection objects, grouped by the categories shown in the connection editors.

Amazon Configuration

Property	Type	Default	Description
AccountId	string		The 12-digit AWS account ID. Used with RoleName for IamIdentityCenter mode to retrieve credentials via SSO GetRoleCredentials instead of STS AssumeRoleWithWebIdentity.
AuthMode	AmazonAuthMode	AmazonAuthMode.Cognito	Specifies the authentication mode: Cognito (browser OAuth via Cognito User Pool), IamIdentityCenter (SSO device-code flow), or SamlToIam (SAML assertion → STS temporary credentials).
AwsRegion	string		The AWS region (e.g. us-east-1) for authentication calls. Defaults to us-east-1 when not specified.
PrincipalArn	string		The ARN of the SAML identity provider in IAM. Required for SamlToIam mode only.
RoleArn	string		The ARN of an IAM role to assume via STS AssumeRoleWithWebIdentity. Optional for IamIdentityCenter — use AccountId + RoleName to retrieve credentials directly via SSO GetRoleCredentials instead. Required for SamlToIam mode.
RoleName	string		The IAM role name (permission set name) within the AWS account. Used with AccountId for IamIdentityCenter mode to retrieve credentials via SSO GetRoleCredentials.
StartUri	string		The AWS access portal URL (https://d-XXXXXXXXXX.awsapps.com/start). Required for the IamIdentityCenter device code flow.

Property

Type

Default

Description

AccountId

string

The 12-digit AWS account ID. Used with RoleName for IamIdentityCenter mode to retrieve credentials via SSO GetRoleCredentials instead of STS AssumeRoleWithWebIdentity.

AuthMode

AmazonAuthMode

AmazonAuthMode.Cognito

Specifies the authentication mode: Cognito (browser OAuth via Cognito User Pool), IamIdentityCenter (SSO device-code flow), or SamlToIam (SAML assertion → STS temporary credentials).

AwsRegion

string

The AWS region (e.g. us-east-1) for authentication calls. Defaults to us-east-1 when not specified.

PrincipalArn

string

The ARN of the SAML identity provider in IAM. Required for SamlToIam mode only.

RoleArn

string

The ARN of an IAM role to assume via STS AssumeRoleWithWebIdentity. Optional for IamIdentityCenter — use AccountId + RoleName to retrieve credentials directly via SSO GetRoleCredentials instead. Required for SamlToIam mode.

RoleName

string

The IAM role name (permission set name) within the AWS account. Used with AccountId for IamIdentityCenter mode to retrieve credentials via SSO GetRoleCredentials.

StartUri

string

The AWS access portal URL (https://d-XXXXXXXXXX.awsapps.com/start). Required for the IamIdentityCenter device code flow.

Authorization Configuration

Property	Type	Default	Description
AuthorityUri displayed as IssuerUri	string		The issuer URI for this connection. For IamIdentityCenter, the IAM Identity Center instance URL (https://identitycenter.amazonaws.com/ssoins-…;). For Cognito, the Cognito domain. For SamlToIam, the IdP SSO URL.
ClientCertificate	string		Sets the certificate used by this connection to get an OAuth token. This property is optional, depending on the GrantType and application configuration. The value of this property can be set to a path, an environment variable resolving to a path, or a base64-encoded X509 certificate containing a private key.
ClientCertificatePassword	string		Sets the certificate password used by this connection to get an OAuth token. This property is optional, depending on the GrantType, application configuration, and ClientCertificate.
ClientID displayed as EntitledApplicationArn	string		The ARN of the pre-registered customer-managed application in IAM Identity Center. Required for the IamIdentityCenter authorization code (PKCE) flow.
ClientSecret	string		Sets the client secret used by this connection to get an OAuth token. This property is optional, depending on the GrantType and application configuration.
GrantType	OAuthGrantType	OAuthGrantType.Authorization_Code	Sets the grant type used by this connection to get an OAuth token.
RedirectUri	string		Sets the redirect URI used by this connection to get an OAuth token. This property is optional, depending on whether the OAuth application is a public or confidential client application.
TenantID	string		Sets the tenant ID used by this connection to get an OAuth token.

Property

Type

Default

Description

AuthorityUri
displayed as IssuerUri

string

The issuer URI for this connection. For IamIdentityCenter, the IAM Identity Center instance URL (https://identitycenter.amazonaws.com/ssoins-…;). For Cognito, the Cognito domain. For SamlToIam, the IdP SSO URL.

ClientCertificate

string

Sets the certificate used by this connection to get an OAuth token. This property is optional, depending on the GrantType and application configuration.

The value of this property can be set to a path, an environment variable resolving to a path, or a base64-encoded X509 certificate containing a private key.

ClientCertificatePassword

string

Sets the certificate password used by this connection to get an OAuth token. This property is optional, depending on the GrantType, application configuration, and ClientCertificate.

ClientID
displayed as EntitledApplicationArn

string

The ARN of the pre-registered customer-managed application in IAM Identity Center. Required for the IamIdentityCenter authorization code (PKCE) flow.

ClientSecret

string

Sets the client secret used by this connection to get an OAuth token. This property is optional, depending on the GrantType and application configuration.

GrantType

OAuthGrantType

OAuthGrantType.Authorization_Code

Sets the grant type used by this connection to get an OAuth token.

RedirectUri

string

Sets the redirect URI used by this connection to get an OAuth token. This property is optional, depending on whether the OAuth application is a public or confidential client application.

TenantID

string

Sets the tenant ID used by this connection to get an OAuth token.

Authorization Form

Property	Type	Default	Description
AuthorizationFormCaption	string		Sets the caption of the authorization form used by this connection to get an OAuth token.
BrowserType	OAuthBrowserType	OAuthBrowserType.Dodeca	Sets the browser type used by this connection to get an OAuth token.

Property

Type

Default

Description

AuthorizationFormCaption

string

Sets the caption of the authorization form used by this connection to get an OAuth token.

BrowserType

OAuthBrowserType

OAuthBrowserType.Dodeca

Sets the browser type used by this connection to get an OAuth token.

Information

Property	Type	Default	Description
ID	string		The string value that uniquely identifies the metadata.
Name	string		The name of the metadata object.

Property

Type

Default

Description

string

The string value that uniquely identifies the metadata.

Name

string

The name of the metadata object.

Test

Property	Type	Description
ResourceUri	string	Sets or returns the resource URI requested by this connection when getting an OAuth token. This property is optional, depending on whether the Scopes property is explicitly configured in metadata or by the consuming connection.
Scopes	List<string>	Sets or returns the scopes requested by this connection when getting an OAuth token. This property is optional, depending on whether the ResourceUri property is explicitly configured in metadata or by the consuming connection.
TestTokens	TokenTable

Property

Type

Default

Description

ResourceUri

string

Sets or returns the resource URI requested by this connection when getting an OAuth token. This property is optional, depending on whether the Scopes property is explicitly configured in metadata or by the consuming connection.

Scopes

List<string>

Sets or returns the scopes requested by this connection when getting an OAuth token. This property is optional, depending on whether the ResourceUri property is explicitly configured in metadata or by the consuming connection.

TestTokens

TokenTable