# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities, _tables
from . import outputs

__all__ = [
    'IdentityPoolCognitoIdentityProvider',
    'IdentityPoolRoleAttachmentRoleMapping',
    'IdentityPoolRoleAttachmentRoleMappingMappingRule',
    'ResourceServerScope',
    'UserPoolAccountRecoverySetting',
    'UserPoolAccountRecoverySettingRecoveryMechanism',
    'UserPoolAdminCreateUserConfig',
    'UserPoolAdminCreateUserConfigInviteMessageTemplate',
    'UserPoolClientAnalyticsConfiguration',
    'UserPoolClientTokenValidityUnits',
    'UserPoolDeviceConfiguration',
    'UserPoolEmailConfiguration',
    'UserPoolLambdaConfig',
    'UserPoolPasswordPolicy',
    'UserPoolSchema',
    'UserPoolSchemaNumberAttributeConstraints',
    'UserPoolSchemaStringAttributeConstraints',
    'UserPoolSmsConfiguration',
    'UserPoolSoftwareTokenMfaConfiguration',
    'UserPoolUserPoolAddOns',
    'UserPoolUsernameConfiguration',
    'UserPoolVerificationMessageTemplate',
]

@pulumi.output_type
class IdentityPoolCognitoIdentityProvider(dict):
    def __init__(__self__, *,
                 client_id: Optional[str] = None,
                 provider_name: Optional[str] = None,
                 server_side_token_check: Optional[bool] = None):
        """
        :param str client_id: The client ID for the Amazon Cognito Identity User Pool.
        :param str provider_name: The provider name for an Amazon Cognito Identity User Pool.
        :param bool server_side_token_check: Whether server-side token validation is enabled for the identity provider’s token or not.
        """
        if client_id is not None:
            pulumi.set(__self__, "client_id", client_id)
        if provider_name is not None:
            pulumi.set(__self__, "provider_name", provider_name)
        if server_side_token_check is not None:
            pulumi.set(__self__, "server_side_token_check", server_side_token_check)

    @property
    @pulumi.getter(name="clientId")
    def client_id(self) -> Optional[str]:
        """
        The client ID for the Amazon Cognito Identity User Pool.
        """
        return pulumi.get(self, "client_id")

    @property
    @pulumi.getter(name="providerName")
    def provider_name(self) -> Optional[str]:
        """
        The provider name for an Amazon Cognito Identity User Pool.
        """
        return pulumi.get(self, "provider_name")

    @property
    @pulumi.getter(name="serverSideTokenCheck")
    def server_side_token_check(self) -> Optional[bool]:
        """
        Whether server-side token validation is enabled for the identity provider’s token or not.
        """
        return pulumi.get(self, "server_side_token_check")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class IdentityPoolRoleAttachmentRoleMapping(dict):
    def __init__(__self__, *,
                 identity_provider: str,
                 type: str,
                 ambiguous_role_resolution: Optional[str] = None,
                 mapping_rules: Optional[Sequence['outputs.IdentityPoolRoleAttachmentRoleMappingMappingRule']] = None):
        """
        :param str identity_provider: A string identifying the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id".
        :param str type: The role mapping type.
        :param str ambiguous_role_resolution: Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. `Required` if you specify Token or Rules as the Type.
        :param Sequence['IdentityPoolRoleAttachmentRoleMappingMappingRuleArgs'] mapping_rules: The Rules Configuration to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
        """
        pulumi.set(__self__, "identity_provider", identity_provider)
        pulumi.set(__self__, "type", type)
        if ambiguous_role_resolution is not None:
            pulumi.set(__self__, "ambiguous_role_resolution", ambiguous_role_resolution)
        if mapping_rules is not None:
            pulumi.set(__self__, "mapping_rules", mapping_rules)

    @property
    @pulumi.getter(name="identityProvider")
    def identity_provider(self) -> str:
        """
        A string identifying the identity provider, for example, "graph.facebook.com" or "cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi:app_client_id".
        """
        return pulumi.get(self, "identity_provider")

    @property
    @pulumi.getter
    def type(self) -> str:
        """
        The role mapping type.
        """
        return pulumi.get(self, "type")

    @property
    @pulumi.getter(name="ambiguousRoleResolution")
    def ambiguous_role_resolution(self) -> Optional[str]:
        """
        Specifies the action to be taken if either no rules match the claim value for the Rules type, or there is no cognito:preferred_role claim and there are multiple cognito:roles matches for the Token type. `Required` if you specify Token or Rules as the Type.
        """
        return pulumi.get(self, "ambiguous_role_resolution")

    @property
    @pulumi.getter(name="mappingRules")
    def mapping_rules(self) -> Optional[Sequence['outputs.IdentityPoolRoleAttachmentRoleMappingMappingRule']]:
        """
        The Rules Configuration to be used for mapping users to roles. You can specify up to 25 rules per identity provider. Rules are evaluated in order. The first one to match specifies the role.
        """
        return pulumi.get(self, "mapping_rules")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class IdentityPoolRoleAttachmentRoleMappingMappingRule(dict):
    def __init__(__self__, *,
                 claim: str,
                 match_type: str,
                 role_arn: str,
                 value: str):
        """
        :param str claim: The claim name that must be present in the token, for example, "isAdmin" or "paid".
        :param str match_type: The match condition that specifies how closely the claim value in the IdP token must match Value.
        :param str role_arn: The role ARN.
        :param str value: A brief string that the claim must match, for example, "paid" or "yes".
        """
        pulumi.set(__self__, "claim", claim)
        pulumi.set(__self__, "match_type", match_type)
        pulumi.set(__self__, "role_arn", role_arn)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def claim(self) -> str:
        """
        The claim name that must be present in the token, for example, "isAdmin" or "paid".
        """
        return pulumi.get(self, "claim")

    @property
    @pulumi.getter(name="matchType")
    def match_type(self) -> str:
        """
        The match condition that specifies how closely the claim value in the IdP token must match Value.
        """
        return pulumi.get(self, "match_type")

    @property
    @pulumi.getter(name="roleArn")
    def role_arn(self) -> str:
        """
        The role ARN.
        """
        return pulumi.get(self, "role_arn")

    @property
    @pulumi.getter
    def value(self) -> str:
        """
        A brief string that the claim must match, for example, "paid" or "yes".
        """
        return pulumi.get(self, "value")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class ResourceServerScope(dict):
    def __init__(__self__, *,
                 scope_description: str,
                 scope_name: str):
        """
        :param str scope_description: The scope description.
        :param str scope_name: The scope name.
        """
        pulumi.set(__self__, "scope_description", scope_description)
        pulumi.set(__self__, "scope_name", scope_name)

    @property
    @pulumi.getter(name="scopeDescription")
    def scope_description(self) -> str:
        """
        The scope description.
        """
        return pulumi.get(self, "scope_description")

    @property
    @pulumi.getter(name="scopeName")
    def scope_name(self) -> str:
        """
        The scope name.
        """
        return pulumi.get(self, "scope_name")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolAccountRecoverySetting(dict):
    def __init__(__self__, *,
                 recovery_mechanisms: Sequence['outputs.UserPoolAccountRecoverySettingRecoveryMechanism']):
        """
        :param Sequence['UserPoolAccountRecoverySettingRecoveryMechanismArgs'] recovery_mechanisms: List of Account Recovery Options of the following structure:
        """
        pulumi.set(__self__, "recovery_mechanisms", recovery_mechanisms)

    @property
    @pulumi.getter(name="recoveryMechanisms")
    def recovery_mechanisms(self) -> Sequence['outputs.UserPoolAccountRecoverySettingRecoveryMechanism']:
        """
        List of Account Recovery Options of the following structure:
        """
        return pulumi.get(self, "recovery_mechanisms")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolAccountRecoverySettingRecoveryMechanism(dict):
    def __init__(__self__, *,
                 name: str,
                 priority: int):
        """
        :param str name: Name of the attribute.
        :param int priority: Positive integer specifying priority of a method with 1 being the highest priority.
        """
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "priority", priority)

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        Name of the attribute.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def priority(self) -> int:
        """
        Positive integer specifying priority of a method with 1 being the highest priority.
        """
        return pulumi.get(self, "priority")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolAdminCreateUserConfig(dict):
    def __init__(__self__, *,
                 allow_admin_create_user_only: Optional[bool] = None,
                 invite_message_template: Optional['outputs.UserPoolAdminCreateUserConfigInviteMessageTemplate'] = None):
        """
        :param bool allow_admin_create_user_only: Set to True if only the administrator is allowed to create user profiles. Set to False if users can sign themselves up via an app.
        :param 'UserPoolAdminCreateUserConfigInviteMessageTemplateArgs' invite_message_template: Invite message template structure. Detailed below.
        """
        if allow_admin_create_user_only is not None:
            pulumi.set(__self__, "allow_admin_create_user_only", allow_admin_create_user_only)
        if invite_message_template is not None:
            pulumi.set(__self__, "invite_message_template", invite_message_template)

    @property
    @pulumi.getter(name="allowAdminCreateUserOnly")
    def allow_admin_create_user_only(self) -> Optional[bool]:
        """
        Set to True if only the administrator is allowed to create user profiles. Set to False if users can sign themselves up via an app.
        """
        return pulumi.get(self, "allow_admin_create_user_only")

    @property
    @pulumi.getter(name="inviteMessageTemplate")
    def invite_message_template(self) -> Optional['outputs.UserPoolAdminCreateUserConfigInviteMessageTemplate']:
        """
        Invite message template structure. Detailed below.
        """
        return pulumi.get(self, "invite_message_template")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolAdminCreateUserConfigInviteMessageTemplate(dict):
    def __init__(__self__, *,
                 email_message: Optional[str] = None,
                 email_subject: Optional[str] = None,
                 sms_message: Optional[str] = None):
        """
        :param str email_message: Email message template. Must contain the `{####}` placeholder. Conflicts with `email_verification_message` argument.
        :param str email_subject: Subject line for the email message template. Conflicts with `email_verification_subject` argument.
        :param str sms_message: SMS message template. Must contain the `{####}` placeholder. Conflicts with `sms_verification_message` argument.
        """
        if email_message is not None:
            pulumi.set(__self__, "email_message", email_message)
        if email_subject is not None:
            pulumi.set(__self__, "email_subject", email_subject)
        if sms_message is not None:
            pulumi.set(__self__, "sms_message", sms_message)

    @property
    @pulumi.getter(name="emailMessage")
    def email_message(self) -> Optional[str]:
        """
        Email message template. Must contain the `{####}` placeholder. Conflicts with `email_verification_message` argument.
        """
        return pulumi.get(self, "email_message")

    @property
    @pulumi.getter(name="emailSubject")
    def email_subject(self) -> Optional[str]:
        """
        Subject line for the email message template. Conflicts with `email_verification_subject` argument.
        """
        return pulumi.get(self, "email_subject")

    @property
    @pulumi.getter(name="smsMessage")
    def sms_message(self) -> Optional[str]:
        """
        SMS message template. Must contain the `{####}` placeholder. Conflicts with `sms_verification_message` argument.
        """
        return pulumi.get(self, "sms_message")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolClientAnalyticsConfiguration(dict):
    def __init__(__self__, *,
                 application_arn: Optional[str] = None,
                 application_id: Optional[str] = None,
                 external_id: Optional[str] = None,
                 role_arn: Optional[str] = None,
                 user_data_shared: Optional[bool] = None):
        """
        :param str application_arn: Application ARN for an Amazon Pinpoint application. Conflicts with `external_id` and `role_arn`.
        :param str application_id: Application ID for an Amazon Pinpoint application.
        :param str external_id: ID for the Analytics Configuration. Conflicts with `application_arn`.
        :param str role_arn: ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `application_arn`.
        :param bool user_data_shared: If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
        """
        if application_arn is not None:
            pulumi.set(__self__, "application_arn", application_arn)
        if application_id is not None:
            pulumi.set(__self__, "application_id", application_id)
        if external_id is not None:
            pulumi.set(__self__, "external_id", external_id)
        if role_arn is not None:
            pulumi.set(__self__, "role_arn", role_arn)
        if user_data_shared is not None:
            pulumi.set(__self__, "user_data_shared", user_data_shared)

    @property
    @pulumi.getter(name="applicationArn")
    def application_arn(self) -> Optional[str]:
        """
        Application ARN for an Amazon Pinpoint application. Conflicts with `external_id` and `role_arn`.
        """
        return pulumi.get(self, "application_arn")

    @property
    @pulumi.getter(name="applicationId")
    def application_id(self) -> Optional[str]:
        """
        Application ID for an Amazon Pinpoint application.
        """
        return pulumi.get(self, "application_id")

    @property
    @pulumi.getter(name="externalId")
    def external_id(self) -> Optional[str]:
        """
        ID for the Analytics Configuration. Conflicts with `application_arn`.
        """
        return pulumi.get(self, "external_id")

    @property
    @pulumi.getter(name="roleArn")
    def role_arn(self) -> Optional[str]:
        """
        ARN of an IAM role that authorizes Amazon Cognito to publish events to Amazon Pinpoint analytics. Conflicts with `application_arn`.
        """
        return pulumi.get(self, "role_arn")

    @property
    @pulumi.getter(name="userDataShared")
    def user_data_shared(self) -> Optional[bool]:
        """
        If set to `true`, Amazon Cognito will include user data in the events it publishes to Amazon Pinpoint analytics.
        """
        return pulumi.get(self, "user_data_shared")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolClientTokenValidityUnits(dict):
    def __init__(__self__, *,
                 access_token: Optional[str] = None,
                 id_token: Optional[str] = None,
                 refresh_token: Optional[str] = None):
        """
        :param str access_token: Time unit in for the value in `access_token_validity`, defaults to `hours`.
        :param str id_token: Time unit in for the value in `id_token_validity`, defaults to `hours`.
        :param str refresh_token: Time unit in for the value in `refresh_token_validity`, defaults to `days`.
        """
        if access_token is not None:
            pulumi.set(__self__, "access_token", access_token)
        if id_token is not None:
            pulumi.set(__self__, "id_token", id_token)
        if refresh_token is not None:
            pulumi.set(__self__, "refresh_token", refresh_token)

    @property
    @pulumi.getter(name="accessToken")
    def access_token(self) -> Optional[str]:
        """
        Time unit in for the value in `access_token_validity`, defaults to `hours`.
        """
        return pulumi.get(self, "access_token")

    @property
    @pulumi.getter(name="idToken")
    def id_token(self) -> Optional[str]:
        """
        Time unit in for the value in `id_token_validity`, defaults to `hours`.
        """
        return pulumi.get(self, "id_token")

    @property
    @pulumi.getter(name="refreshToken")
    def refresh_token(self) -> Optional[str]:
        """
        Time unit in for the value in `refresh_token_validity`, defaults to `days`.
        """
        return pulumi.get(self, "refresh_token")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolDeviceConfiguration(dict):
    def __init__(__self__, *,
                 challenge_required_on_new_device: Optional[bool] = None,
                 device_only_remembered_on_user_prompt: Optional[bool] = None):
        """
        :param bool challenge_required_on_new_device: Whether a challenge is required on a new device. Only applicable to a new device.
        :param bool device_only_remembered_on_user_prompt: Whether a device is only remembered on user prompt. `false` equates to "Always" remember, `true` is "User Opt In," and not using a `device_configuration` block is "No."
        """
        if challenge_required_on_new_device is not None:
            pulumi.set(__self__, "challenge_required_on_new_device", challenge_required_on_new_device)
        if device_only_remembered_on_user_prompt is not None:
            pulumi.set(__self__, "device_only_remembered_on_user_prompt", device_only_remembered_on_user_prompt)

    @property
    @pulumi.getter(name="challengeRequiredOnNewDevice")
    def challenge_required_on_new_device(self) -> Optional[bool]:
        """
        Whether a challenge is required on a new device. Only applicable to a new device.
        """
        return pulumi.get(self, "challenge_required_on_new_device")

    @property
    @pulumi.getter(name="deviceOnlyRememberedOnUserPrompt")
    def device_only_remembered_on_user_prompt(self) -> Optional[bool]:
        """
        Whether a device is only remembered on user prompt. `false` equates to "Always" remember, `true` is "User Opt In," and not using a `device_configuration` block is "No."
        """
        return pulumi.get(self, "device_only_remembered_on_user_prompt")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolEmailConfiguration(dict):
    def __init__(__self__, *,
                 configuration_set: Optional[str] = None,
                 email_sending_account: Optional[str] = None,
                 from_email_address: Optional[str] = None,
                 reply_to_email_address: Optional[str] = None,
                 source_arn: Optional[str] = None):
        """
        :param str configuration_set: Email configuration set name from SES.
        :param str email_sending_account: Email delivery method to use. `COGNITO_DEFAULT` for the default email functionality built into Cognito or `DEVELOPER` to use your Amazon SES configuration.
        :param str from_email_address: Sender’s email address or sender’s display name with their email address (e.g. `john@example.com`, `John Smith <john@example.com>` or `\"John Smith Ph.D.\" <john@example.com>`). Escaped double quotes are required around display names that contain certain characters as specified in [RFC 5322](https://tools.ietf.org/html/rfc5322).
        :param str reply_to_email_address: REPLY-TO email address.
        :param str source_arn: ARN of the SES verified email identity to to use. Required if `email_sending_account` is set to `DEVELOPER`.
        """
        if configuration_set is not None:
            pulumi.set(__self__, "configuration_set", configuration_set)
        if email_sending_account is not None:
            pulumi.set(__self__, "email_sending_account", email_sending_account)
        if from_email_address is not None:
            pulumi.set(__self__, "from_email_address", from_email_address)
        if reply_to_email_address is not None:
            pulumi.set(__self__, "reply_to_email_address", reply_to_email_address)
        if source_arn is not None:
            pulumi.set(__self__, "source_arn", source_arn)

    @property
    @pulumi.getter(name="configurationSet")
    def configuration_set(self) -> Optional[str]:
        """
        Email configuration set name from SES.
        """
        return pulumi.get(self, "configuration_set")

    @property
    @pulumi.getter(name="emailSendingAccount")
    def email_sending_account(self) -> Optional[str]:
        """
        Email delivery method to use. `COGNITO_DEFAULT` for the default email functionality built into Cognito or `DEVELOPER` to use your Amazon SES configuration.
        """
        return pulumi.get(self, "email_sending_account")

    @property
    @pulumi.getter(name="fromEmailAddress")
    def from_email_address(self) -> Optional[str]:
        """
        Sender’s email address or sender’s display name with their email address (e.g. `john@example.com`, `John Smith <john@example.com>` or `\"John Smith Ph.D.\" <john@example.com>`). Escaped double quotes are required around display names that contain certain characters as specified in [RFC 5322](https://tools.ietf.org/html/rfc5322).
        """
        return pulumi.get(self, "from_email_address")

    @property
    @pulumi.getter(name="replyToEmailAddress")
    def reply_to_email_address(self) -> Optional[str]:
        """
        REPLY-TO email address.
        """
        return pulumi.get(self, "reply_to_email_address")

    @property
    @pulumi.getter(name="sourceArn")
    def source_arn(self) -> Optional[str]:
        """
        ARN of the SES verified email identity to to use. Required if `email_sending_account` is set to `DEVELOPER`.
        """
        return pulumi.get(self, "source_arn")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolLambdaConfig(dict):
    def __init__(__self__, *,
                 create_auth_challenge: Optional[str] = None,
                 custom_message: Optional[str] = None,
                 define_auth_challenge: Optional[str] = None,
                 post_authentication: Optional[str] = None,
                 post_confirmation: Optional[str] = None,
                 pre_authentication: Optional[str] = None,
                 pre_sign_up: Optional[str] = None,
                 pre_token_generation: Optional[str] = None,
                 user_migration: Optional[str] = None,
                 verify_auth_challenge_response: Optional[str] = None):
        """
        :param str create_auth_challenge: ARN of the lambda creating an authentication challenge.
        :param str custom_message: Custom Message AWS Lambda trigger.
        :param str define_auth_challenge: Defines the authentication challenge.
        :param str post_authentication: Post-authentication AWS Lambda trigger.
        :param str post_confirmation: Post-confirmation AWS Lambda trigger.
        :param str pre_authentication: Pre-authentication AWS Lambda trigger.
        :param str pre_sign_up: Pre-registration AWS Lambda trigger.
        :param str pre_token_generation: Allow to customize identity token claims before token generation.
        :param str user_migration: User migration Lambda config type.
        :param str verify_auth_challenge_response: Verifies the authentication challenge response.
        """
        if create_auth_challenge is not None:
            pulumi.set(__self__, "create_auth_challenge", create_auth_challenge)
        if custom_message is not None:
            pulumi.set(__self__, "custom_message", custom_message)
        if define_auth_challenge is not None:
            pulumi.set(__self__, "define_auth_challenge", define_auth_challenge)
        if post_authentication is not None:
            pulumi.set(__self__, "post_authentication", post_authentication)
        if post_confirmation is not None:
            pulumi.set(__self__, "post_confirmation", post_confirmation)
        if pre_authentication is not None:
            pulumi.set(__self__, "pre_authentication", pre_authentication)
        if pre_sign_up is not None:
            pulumi.set(__self__, "pre_sign_up", pre_sign_up)
        if pre_token_generation is not None:
            pulumi.set(__self__, "pre_token_generation", pre_token_generation)
        if user_migration is not None:
            pulumi.set(__self__, "user_migration", user_migration)
        if verify_auth_challenge_response is not None:
            pulumi.set(__self__, "verify_auth_challenge_response", verify_auth_challenge_response)

    @property
    @pulumi.getter(name="createAuthChallenge")
    def create_auth_challenge(self) -> Optional[str]:
        """
        ARN of the lambda creating an authentication challenge.
        """
        return pulumi.get(self, "create_auth_challenge")

    @property
    @pulumi.getter(name="customMessage")
    def custom_message(self) -> Optional[str]:
        """
        Custom Message AWS Lambda trigger.
        """
        return pulumi.get(self, "custom_message")

    @property
    @pulumi.getter(name="defineAuthChallenge")
    def define_auth_challenge(self) -> Optional[str]:
        """
        Defines the authentication challenge.
        """
        return pulumi.get(self, "define_auth_challenge")

    @property
    @pulumi.getter(name="postAuthentication")
    def post_authentication(self) -> Optional[str]:
        """
        Post-authentication AWS Lambda trigger.
        """
        return pulumi.get(self, "post_authentication")

    @property
    @pulumi.getter(name="postConfirmation")
    def post_confirmation(self) -> Optional[str]:
        """
        Post-confirmation AWS Lambda trigger.
        """
        return pulumi.get(self, "post_confirmation")

    @property
    @pulumi.getter(name="preAuthentication")
    def pre_authentication(self) -> Optional[str]:
        """
        Pre-authentication AWS Lambda trigger.
        """
        return pulumi.get(self, "pre_authentication")

    @property
    @pulumi.getter(name="preSignUp")
    def pre_sign_up(self) -> Optional[str]:
        """
        Pre-registration AWS Lambda trigger.
        """
        return pulumi.get(self, "pre_sign_up")

    @property
    @pulumi.getter(name="preTokenGeneration")
    def pre_token_generation(self) -> Optional[str]:
        """
        Allow to customize identity token claims before token generation.
        """
        return pulumi.get(self, "pre_token_generation")

    @property
    @pulumi.getter(name="userMigration")
    def user_migration(self) -> Optional[str]:
        """
        User migration Lambda config type.
        """
        return pulumi.get(self, "user_migration")

    @property
    @pulumi.getter(name="verifyAuthChallengeResponse")
    def verify_auth_challenge_response(self) -> Optional[str]:
        """
        Verifies the authentication challenge response.
        """
        return pulumi.get(self, "verify_auth_challenge_response")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolPasswordPolicy(dict):
    def __init__(__self__, *,
                 minimum_length: Optional[int] = None,
                 require_lowercase: Optional[bool] = None,
                 require_numbers: Optional[bool] = None,
                 require_symbols: Optional[bool] = None,
                 require_uppercase: Optional[bool] = None,
                 temporary_password_validity_days: Optional[int] = None):
        """
        :param int minimum_length: Minimum length of the password policy that you have set.
        :param bool require_lowercase: Whether you have required users to use at least one lowercase letter in their password.
        :param bool require_numbers: Whether you have required users to use at least one number in their password.
        :param bool require_symbols: Whether you have required users to use at least one symbol in their password.
        :param bool require_uppercase: Whether you have required users to use at least one uppercase letter in their password.
        :param int temporary_password_validity_days: In the password policy you have set, refers to the number of days a temporary password is valid. If the user does not sign-in during this time, their password will need to be reset by an administrator.
        """
        if minimum_length is not None:
            pulumi.set(__self__, "minimum_length", minimum_length)
        if require_lowercase is not None:
            pulumi.set(__self__, "require_lowercase", require_lowercase)
        if require_numbers is not None:
            pulumi.set(__self__, "require_numbers", require_numbers)
        if require_symbols is not None:
            pulumi.set(__self__, "require_symbols", require_symbols)
        if require_uppercase is not None:
            pulumi.set(__self__, "require_uppercase", require_uppercase)
        if temporary_password_validity_days is not None:
            pulumi.set(__self__, "temporary_password_validity_days", temporary_password_validity_days)

    @property
    @pulumi.getter(name="minimumLength")
    def minimum_length(self) -> Optional[int]:
        """
        Minimum length of the password policy that you have set.
        """
        return pulumi.get(self, "minimum_length")

    @property
    @pulumi.getter(name="requireLowercase")
    def require_lowercase(self) -> Optional[bool]:
        """
        Whether you have required users to use at least one lowercase letter in their password.
        """
        return pulumi.get(self, "require_lowercase")

    @property
    @pulumi.getter(name="requireNumbers")
    def require_numbers(self) -> Optional[bool]:
        """
        Whether you have required users to use at least one number in their password.
        """
        return pulumi.get(self, "require_numbers")

    @property
    @pulumi.getter(name="requireSymbols")
    def require_symbols(self) -> Optional[bool]:
        """
        Whether you have required users to use at least one symbol in their password.
        """
        return pulumi.get(self, "require_symbols")

    @property
    @pulumi.getter(name="requireUppercase")
    def require_uppercase(self) -> Optional[bool]:
        """
        Whether you have required users to use at least one uppercase letter in their password.
        """
        return pulumi.get(self, "require_uppercase")

    @property
    @pulumi.getter(name="temporaryPasswordValidityDays")
    def temporary_password_validity_days(self) -> Optional[int]:
        """
        In the password policy you have set, refers to the number of days a temporary password is valid. If the user does not sign-in during this time, their password will need to be reset by an administrator.
        """
        return pulumi.get(self, "temporary_password_validity_days")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolSchema(dict):
    def __init__(__self__, *,
                 attribute_data_type: str,
                 name: str,
                 developer_only_attribute: Optional[bool] = None,
                 mutable: Optional[bool] = None,
                 number_attribute_constraints: Optional['outputs.UserPoolSchemaNumberAttributeConstraints'] = None,
                 required: Optional[bool] = None,
                 string_attribute_constraints: Optional['outputs.UserPoolSchemaStringAttributeConstraints'] = None):
        """
        :param str attribute_data_type: Attribute data type. Must be one of `Boolean`, `Number`, `String`, `DateTime`.
        :param str name: Name of the attribute.
        :param bool developer_only_attribute: Whether the attribute type is developer only.
        :param bool mutable: Whether the attribute can be changed once it has been created.
        :param 'UserPoolSchemaNumberAttributeConstraintsArgs' number_attribute_constraints: Configuration block for the constraints for an attribute of the number type. Detailed below.
        :param bool required: Whether a user pool attribute is required. If the attribute is required and the user does not provide a value, registration or sign-in will fail.
        :param 'UserPoolSchemaStringAttributeConstraintsArgs' string_attribute_constraints: Constraints for an attribute of the string type. Detailed below.
        """
        pulumi.set(__self__, "attribute_data_type", attribute_data_type)
        pulumi.set(__self__, "name", name)
        if developer_only_attribute is not None:
            pulumi.set(__self__, "developer_only_attribute", developer_only_attribute)
        if mutable is not None:
            pulumi.set(__self__, "mutable", mutable)
        if number_attribute_constraints is not None:
            pulumi.set(__self__, "number_attribute_constraints", number_attribute_constraints)
        if required is not None:
            pulumi.set(__self__, "required", required)
        if string_attribute_constraints is not None:
            pulumi.set(__self__, "string_attribute_constraints", string_attribute_constraints)

    @property
    @pulumi.getter(name="attributeDataType")
    def attribute_data_type(self) -> str:
        """
        Attribute data type. Must be one of `Boolean`, `Number`, `String`, `DateTime`.
        """
        return pulumi.get(self, "attribute_data_type")

    @property
    @pulumi.getter
    def name(self) -> str:
        """
        Name of the attribute.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter(name="developerOnlyAttribute")
    def developer_only_attribute(self) -> Optional[bool]:
        """
        Whether the attribute type is developer only.
        """
        return pulumi.get(self, "developer_only_attribute")

    @property
    @pulumi.getter
    def mutable(self) -> Optional[bool]:
        """
        Whether the attribute can be changed once it has been created.
        """
        return pulumi.get(self, "mutable")

    @property
    @pulumi.getter(name="numberAttributeConstraints")
    def number_attribute_constraints(self) -> Optional['outputs.UserPoolSchemaNumberAttributeConstraints']:
        """
        Configuration block for the constraints for an attribute of the number type. Detailed below.
        """
        return pulumi.get(self, "number_attribute_constraints")

    @property
    @pulumi.getter
    def required(self) -> Optional[bool]:
        """
        Whether a user pool attribute is required. If the attribute is required and the user does not provide a value, registration or sign-in will fail.
        """
        return pulumi.get(self, "required")

    @property
    @pulumi.getter(name="stringAttributeConstraints")
    def string_attribute_constraints(self) -> Optional['outputs.UserPoolSchemaStringAttributeConstraints']:
        """
        Constraints for an attribute of the string type. Detailed below.
        """
        return pulumi.get(self, "string_attribute_constraints")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolSchemaNumberAttributeConstraints(dict):
    def __init__(__self__, *,
                 max_value: Optional[str] = None,
                 min_value: Optional[str] = None):
        """
        :param str max_value: Maximum value of an attribute that is of the number data type.
        :param str min_value: Minimum value of an attribute that is of the number data type.
        """
        if max_value is not None:
            pulumi.set(__self__, "max_value", max_value)
        if min_value is not None:
            pulumi.set(__self__, "min_value", min_value)

    @property
    @pulumi.getter(name="maxValue")
    def max_value(self) -> Optional[str]:
        """
        Maximum value of an attribute that is of the number data type.
        """
        return pulumi.get(self, "max_value")

    @property
    @pulumi.getter(name="minValue")
    def min_value(self) -> Optional[str]:
        """
        Minimum value of an attribute that is of the number data type.
        """
        return pulumi.get(self, "min_value")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolSchemaStringAttributeConstraints(dict):
    def __init__(__self__, *,
                 max_length: Optional[str] = None,
                 min_length: Optional[str] = None):
        """
        :param str max_length: Maximum length of an attribute value of the string type.
        :param str min_length: Minimum length of an attribute value of the string type.
        """
        if max_length is not None:
            pulumi.set(__self__, "max_length", max_length)
        if min_length is not None:
            pulumi.set(__self__, "min_length", min_length)

    @property
    @pulumi.getter(name="maxLength")
    def max_length(self) -> Optional[str]:
        """
        Maximum length of an attribute value of the string type.
        """
        return pulumi.get(self, "max_length")

    @property
    @pulumi.getter(name="minLength")
    def min_length(self) -> Optional[str]:
        """
        Minimum length of an attribute value of the string type.
        """
        return pulumi.get(self, "min_length")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolSmsConfiguration(dict):
    def __init__(__self__, *,
                 external_id: str,
                 sns_caller_arn: str):
        """
        :param str external_id: External ID used in IAM role trust relationships. For more information about using external IDs, see [How to Use an External ID When Granting Access to Your AWS Resources to a Third Party](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
        :param str sns_caller_arn: ARN of the Amazon SNS caller. This is usually the IAM role that you've given Cognito permission to assume.
        """
        pulumi.set(__self__, "external_id", external_id)
        pulumi.set(__self__, "sns_caller_arn", sns_caller_arn)

    @property
    @pulumi.getter(name="externalId")
    def external_id(self) -> str:
        """
        External ID used in IAM role trust relationships. For more information about using external IDs, see [How to Use an External ID When Granting Access to Your AWS Resources to a Third Party](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
        """
        return pulumi.get(self, "external_id")

    @property
    @pulumi.getter(name="snsCallerArn")
    def sns_caller_arn(self) -> str:
        """
        ARN of the Amazon SNS caller. This is usually the IAM role that you've given Cognito permission to assume.
        """
        return pulumi.get(self, "sns_caller_arn")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolSoftwareTokenMfaConfiguration(dict):
    def __init__(__self__, *,
                 enabled: bool):
        """
        :param bool enabled: Boolean whether to enable software token Multi-Factor (MFA) tokens, such as Time-based One-Time Password (TOTP). To disable software token MFA When `sms_configuration` is not present, the `mfa_configuration` argument must be set to `OFF` and the `software_token_mfa_configuration` configuration block must be fully removed.
        """
        pulumi.set(__self__, "enabled", enabled)

    @property
    @pulumi.getter
    def enabled(self) -> bool:
        """
        Boolean whether to enable software token Multi-Factor (MFA) tokens, such as Time-based One-Time Password (TOTP). To disable software token MFA When `sms_configuration` is not present, the `mfa_configuration` argument must be set to `OFF` and the `software_token_mfa_configuration` configuration block must be fully removed.
        """
        return pulumi.get(self, "enabled")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolUserPoolAddOns(dict):
    def __init__(__self__, *,
                 advanced_security_mode: str):
        """
        :param str advanced_security_mode: Mode for advanced security, must be one of `OFF`, `AUDIT` or `ENFORCED`.
        """
        pulumi.set(__self__, "advanced_security_mode", advanced_security_mode)

    @property
    @pulumi.getter(name="advancedSecurityMode")
    def advanced_security_mode(self) -> str:
        """
        Mode for advanced security, must be one of `OFF`, `AUDIT` or `ENFORCED`.
        """
        return pulumi.get(self, "advanced_security_mode")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolUsernameConfiguration(dict):
    def __init__(__self__, *,
                 case_sensitive: bool):
        """
        :param bool case_sensitive: Whether username case sensitivity will be applied for all users in the user pool through Cognito APIs.
        """
        pulumi.set(__self__, "case_sensitive", case_sensitive)

    @property
    @pulumi.getter(name="caseSensitive")
    def case_sensitive(self) -> bool:
        """
        Whether username case sensitivity will be applied for all users in the user pool through Cognito APIs.
        """
        return pulumi.get(self, "case_sensitive")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


@pulumi.output_type
class UserPoolVerificationMessageTemplate(dict):
    def __init__(__self__, *,
                 default_email_option: Optional[str] = None,
                 email_message: Optional[str] = None,
                 email_message_by_link: Optional[str] = None,
                 email_subject: Optional[str] = None,
                 email_subject_by_link: Optional[str] = None,
                 sms_message: Optional[str] = None):
        """
        :param str default_email_option: Default email option. Must be either `CONFIRM_WITH_CODE` or `CONFIRM_WITH_LINK`. Defaults to `CONFIRM_WITH_CODE`.
        :param str email_message: Email message template. Must contain the `{####}` placeholder. Conflicts with `email_verification_message` argument.
        :param str email_message_by_link: Email message template for sending a confirmation link to the user, it must contain the `{##Click Here##}` placeholder.
        :param str email_subject: Subject line for the email message template. Conflicts with `email_verification_subject` argument.
        :param str email_subject_by_link: Subject line for the email message template for sending a confirmation link to the user.
        :param str sms_message: SMS message template. Must contain the `{####}` placeholder. Conflicts with `sms_verification_message` argument.
        """
        if default_email_option is not None:
            pulumi.set(__self__, "default_email_option", default_email_option)
        if email_message is not None:
            pulumi.set(__self__, "email_message", email_message)
        if email_message_by_link is not None:
            pulumi.set(__self__, "email_message_by_link", email_message_by_link)
        if email_subject is not None:
            pulumi.set(__self__, "email_subject", email_subject)
        if email_subject_by_link is not None:
            pulumi.set(__self__, "email_subject_by_link", email_subject_by_link)
        if sms_message is not None:
            pulumi.set(__self__, "sms_message", sms_message)

    @property
    @pulumi.getter(name="defaultEmailOption")
    def default_email_option(self) -> Optional[str]:
        """
        Default email option. Must be either `CONFIRM_WITH_CODE` or `CONFIRM_WITH_LINK`. Defaults to `CONFIRM_WITH_CODE`.
        """
        return pulumi.get(self, "default_email_option")

    @property
    @pulumi.getter(name="emailMessage")
    def email_message(self) -> Optional[str]:
        """
        Email message template. Must contain the `{####}` placeholder. Conflicts with `email_verification_message` argument.
        """
        return pulumi.get(self, "email_message")

    @property
    @pulumi.getter(name="emailMessageByLink")
    def email_message_by_link(self) -> Optional[str]:
        """
        Email message template for sending a confirmation link to the user, it must contain the `{##Click Here##}` placeholder.
        """
        return pulumi.get(self, "email_message_by_link")

    @property
    @pulumi.getter(name="emailSubject")
    def email_subject(self) -> Optional[str]:
        """
        Subject line for the email message template. Conflicts with `email_verification_subject` argument.
        """
        return pulumi.get(self, "email_subject")

    @property
    @pulumi.getter(name="emailSubjectByLink")
    def email_subject_by_link(self) -> Optional[str]:
        """
        Subject line for the email message template for sending a confirmation link to the user.
        """
        return pulumi.get(self, "email_subject_by_link")

    @property
    @pulumi.getter(name="smsMessage")
    def sms_message(self) -> Optional[str]:
        """
        SMS message template. Must contain the `{####}` placeholder. Conflicts with `sms_verification_message` argument.
        """
        return pulumi.get(self, "sms_message")

    def _translate_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop


