Interface IdentityProviderConfiguration

The authorization strategy for the datastore. Required when IdentityProviderConfiguration is provided. To use IAM-based access (Signature v4), omit IdentityProviderConfiguration entirely on the datastore — HealthLake defaults to AWS_AUTH at that level.

• AWS_AUTH — IAM-based access (Signature v4). No additional configuration needed.
• SMART_ON_FHIR_V1 — SMART on FHIR V1 with read/write permissions.
• SMART_ON_FHIR — Full SMART on FHIR V1+V2 with CRUD+search permissions.

Enable SMART on FHIR fine-grained authorization for scoped access per patient/resource. Only applicable when authorizationStrategy is SMART_ON_FHIR or SMART_ON_FHIR_V1.

ARN of the Lambda function that decodes the OAuth2 access token from your authorization server. Required when using SMART on FHIR authorization strategies.

JSON string containing SMART App Launch metadata for your identity provider. Optional per the HealthLake API; when provided, the following elements are required by the SMART App Launch specification:

• authorization_endpoint — URL to the OAuth2 authorization endpoint
• grant_types_supported — Array of grant types (authorization_code, client_credentials); at least one required
• token_endpoint — URL to the OAuth2 token endpoint
• capabilities — Array of SMART capabilities the authorization server supports
• code_challenge_methods_supported — Must include S256

See https://docs.aws.amazon.com/healthlake/latest/APIReference/API_IdentityProviderConfiguration.html