AWS::HealthLake::FHIRDatastore IdentityProviderConfiguration - Amazon CloudFormation
SyntaxProperties
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AWS::HealthLake::FHIRDatastore IdentityProviderConfiguration

The identity provider configuration that you gave when the data store was created.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{
  "AuthorizationStrategy" : String,
  "FineGrainedAuthorizationEnabled" : Boolean,
  "IdpLambdaArn" : String,
  "Metadata" : String
}

Properties

AuthorizationStrategy

The authorization strategy that you selected when you created the data store.

Required: Yes

Type: String

Allowed values: SMART_ON_FHIR_V1 | AWS_AUTH

Update requires: Replacement

FineGrainedAuthorizationEnabled

If you enabled fine-grained authorization when you created the data store.

Required: No

Type: Boolean

Update requires: Replacement

IdpLambdaArn

The Amazon Resource Name (ARN) of the Lambda function that you want to use to decode the access token created by the authorization server.

Required: No

Type: String

Pattern: arn:aws[-a-z]*:lambda:[a-z]{2}-[a-z]+-\d{1}:\d{12}:function:[a-zA-Z0-9\-_\.]+(:(\$LATEST|[a-zA-Z0-9\-_]+))?

Minimum: 49

Maximum: 256

Update requires: Replacement

Metadata

The JSON metadata elements that you want to use in your identity provider configuration. Required elements are listed based on the launch specification of the SMART application. For more information on all possible elements, see Metadata in SMART's App Launch specification.

authorization_endpoint: The URL to the OAuth2 authorization endpoint.

grant_types_supported: An array of grant types that are supported at the token endpoint. You must provide at least one grant type option. Valid options are authorization_code and client_credentials.

token_endpoint: The URL to the OAuth2 token endpoint.

capabilities: An array of strings of the SMART capabilities that the authorization server supports.

code_challenge_methods_supported: An array of strings of supported PKCE code challenge methods. You must include the S256 method in the array of PKCE code challenge methods.

Required: No

Type: String

Update requires: Replacement