The module creates base resources such as a user pool, Route53 record for a domain, and ACM certificates for it.
This example demonstrates how you can create an AWS Cognito client for your application.
module "cognito" {
source = "github.com/provectus/sak-cognito.git"
cluster_name = module.eks.cluster_id
domain = "example.com"
zone_id = "FOOBAR123456"
}
resource aws_cognito_user_pool_client this {
name = "foo"
user_pool_id = module.cognito.pool_id
callback_urls = ["https://foo.example.com/oauth2/idpresponse"]
allowed_oauth_flows_user_pool_client = true
allowed_oauth_scopes = ["email", "openid", "profile", "aws.cognito.signin.user.admin"]
allowed_oauth_flows = ["code"]
supported_identity_providers = ["COGNITO"]
generate_secret = true
}
terraform >= 1.1
Name | Version |
---|---|
aws | >= 3.0 |
random | >= 3.1.0 |
Name | Description | Type | Default | Required |
---|---|---|---|---|
cluster_name | A name of the cluster | string |
n/a | yes |
domain | n/a | string |
n/a | yes |
tags | A set of tags | map(string) |
{} |
no |
zone_id | n/a | string |
n/a | yes |
Name | Description |
---|---|
domain | A custom domain name of the AWS Cognito endpoint |
pool_arn | An ARN of the new created AWS Cognito User Pool |
pool_id | An ID of the new created AWS Cognito User Pool |
Right now Terraform provider for AWS did not support the creation of users for User Pool, so if you want to start managing users by Terraform need to use the following configuration with local-exec
provisioner:
resource aws_cognito_user_group this {
for_each = toset(distinct(values(
{
for k, v in var.cognito_users :
k => lookup(v, "group", "read-only")
}
)))
name = each.value
user_pool_id = module.cognito.pool_id
}
resource null_resource cognito_users {
depends_on = [aws_cognito_user_group.this]
for_each = {
for k, v in var.cognito_users :
v.username => v
}
provisioner local-exec {
command = "aws --region ${var.aws_region} cognito-idp admin-create-user --user-pool-id ${module.cognito.pool_id} --username ${each.key} --user-attributes Name=email,Value=${each.value.email}"
}
provisioner local-exec {
command = "aws --region ${var.aws_region} cognito-idp admin-add-user-to-group --user-pool-id ${module.cognito.pool_id} --username ${each.key} --group-name ${lookup(each.value, "group", "read-only")}"
}
provisioner local-exec {
when = "destroy"
command = "aws --region ${var.aws_region} cognito-idp admin-delete-user --user-pool-id ${module.cognito.pool_id} --username ${each.key}"
}
}