The principal, which can be a certificate ARN (as returned from the CreateCertificate operation) or an Amazon Cognito ID.