Skip to content

Latest commit

 

History

History
86 lines (75 loc) · 2.89 KB

README.md

File metadata and controls

86 lines (75 loc) · 2.89 KB

Cognito

The module creates base resources such as a user pool, Route53 record for a domain, and ACM certificates for it.

Example

This example demonstrates how you can create an AWS Cognito client for your application.

module "cognito" {
  source       = "github.com/provectus/sak-cognito.git"
  cluster_name = module.eks.cluster_id
  domain       = "example.com"
  zone_id      = "FOOBAR123456"
}

resource aws_cognito_user_pool_client this {
  name                                 = "foo"
  user_pool_id                         = module.cognito.pool_id
  callback_urls                        = ["https://foo.example.com/oauth2/idpresponse"]
  allowed_oauth_flows_user_pool_client = true
  allowed_oauth_scopes                 = ["email", "openid", "profile", "aws.cognito.signin.user.admin"]
  allowed_oauth_flows                  = ["code"]
  supported_identity_providers         = ["COGNITO"]
  generate_secret                      = true
}

Requirements

terraform >= 1.1

Providers

Name Version
aws >= 3.0
random >= 3.1.0

Inputs

Name Description Type Default Required
cluster_name A name of the cluster string n/a yes
domain n/a string n/a yes
tags A set of tags map(string) {} no
zone_id n/a string n/a yes

Outputs

Name Description
domain A custom domain name of the AWS Cognito endpoint
pool_arn An ARN of the new created AWS Cognito User Pool
pool_id An ID of the new created AWS Cognito User Pool

Known issues

Right now Terraform provider for AWS did not support the creation of users for User Pool, so if you want to start managing users by Terraform need to use the following configuration with local-exec provisioner:

resource aws_cognito_user_group this {
  for_each = toset(distinct(values(
    {
      for k, v in var.cognito_users :
      k => lookup(v, "group", "read-only")
    }
  )))
  name         = each.value
  user_pool_id = module.cognito.pool_id
}

resource null_resource cognito_users {
  depends_on = [aws_cognito_user_group.this]
  for_each = {
    for k, v in var.cognito_users :
    v.username => v
  }
  provisioner local-exec {
    command = "aws --region ${var.aws_region} cognito-idp admin-create-user --user-pool-id ${module.cognito.pool_id} --username ${each.key} --user-attributes Name=email,Value=${each.value.email}"
  }
  provisioner local-exec {
    command = "aws --region ${var.aws_region} cognito-idp admin-add-user-to-group --user-pool-id ${module.cognito.pool_id} --username ${each.key} --group-name ${lookup(each.value, "group", "read-only")}"
  }
  provisioner local-exec {
    when    = "destroy"
    command = "aws --region ${var.aws_region} cognito-idp admin-delete-user --user-pool-id ${module.cognito.pool_id} --username ${each.key}"
  }
}