Adding Multiple Identity Providers to Amazon Verified Permissions

Question

Hello, I am attempting to setup amazon verified permissions, but I am hitting what seems to be a fairly strange limitation - it appears that I can only add a single Identity Source to my Policy Store.
I have a newly setup cognito pool added, but I need to add an additional Identity Source for an OIDC Provider, when submitting the request to get create the Identity Source I am getting `Server exception: Identity Source Limit Exceeded.` as an error in the console.
I haven't been able to find a documented limit for identity sources, and in using the CLI to check allowances/quotas, I don't see anything listed either.

The UI in the console certainly seems to be designed to manage multiple identity sources, but perhaps there is something key I am missing? Any help or guidance would be very much appreciated!

re:Post Agent · Answer

Based on the available information, Amazon Verified Permissions does support multiple identity sources, including both Amazon Cognito user pools and OpenID Connect (OIDC) identity providers. The console interface is indeed designed to manage multiple identity sources.

The error message you're receiving ("Identity Source Limit Exceeded") suggests there might be a limit in place, but this limit isn't explicitly documented in the provided information. This could be a service limitation that isn't well-documented in the public documentation.

Here are some approaches you might try:

1. Check if you're using the correct policy store ID when creating the new identity source. Each identity source is associated with a specific policy store, and the error might occur if there's an issue with this association.

2. Try using the AWS CLI to create the identity source instead of the console. The CLI command would look something like:
```
aws verifiedpermissions create-identity-source \
--configuration file://config.txt \
--policy-store-id YOUR_POLICY_STORE_ID \
--principal-entity-type YOUR_ENTITY_TYPE
```

3. Contact AWS Support for clarification on any service limits related to identity sources per policy store, as this specific limit doesn't appear to be documented in the public materials.

When creating an identity source, remember that you need to specify the policy store ID, and for OIDC providers, you'll need to provide details like the issuer URL, token type, client IDs, and principal ID claim. You may also need to update your schema to include the extracted attributes for referencing them in Cedar policies.  
**Sources**  
[Secure your applications with identity sources and tokens - Amazon Verified Permissions](https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/identity-sources.html)  
[Editing Amazon Verified Permissions OIDC identity sources - Amazon Verified Permissions](https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/oidc-edit.html)  
[CreateIdentitySource - Amazon Verified Permissions](https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_CreateIdentitySource.html)  
[Creating Amazon Verified Permissions OIDC identity sources - Amazon Verified Permissions](https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/oidc-create.html)

Harika · Answer

Hello,

Kindly note that currently there is a hard limit for Identity sources per policy store as per the document here [+] and this limit cannot be increased.

[+] https://docs.aws.amazon.com/verifiedpermissions/latest/userguide/quotas.html#quotas-resources

Adding Multiple Identity Providers to Amazon Verified Permissions

Add your answer

Relevant content