Gems/AWSClientAuth/cdk/cognito/cognito_user

""" Copyright (c) Contributors to the Open 3D Engine Project. For complete copyright and license terms please see the LICENSE at the root of this distribution. SPDX-License-Identifier: Apache-2.0 OR MIT """ from aws_cdk import ( CfnOutput, Environment, aws_cognito as cognito ) from constructs import Construct from auth.cognito_user_pool_sms_role import CognitoUserPoolSMSRole from utils import name_utils class CognitoUserPool: """ Creates User pool. Sets up MFA with text. Allows enabling MFA. Allows signing up by email and phone. """ def __init__(self, scope: Construct, feature_name: str, project_name: str, env: Environment, sms_role: CognitoUserPoolSMSRole) -> None: """ :param scope: Construct role scope will be attached to. :param feature_name: Name of the feature for resource. :param project_name: Name of the project for resource. :param env: Environment set up by App. :param sms_role: SMS IAM role created using """ self._user_pool = \ cognito.CfnUserPool(scope, name_utils.format_aws_resource_id(feature_name, project_name, env, cognito.CfnUserPool.__name__), user_pool_name=name_utils.format_aws_resource_name(feature_name, project_name, env, cognito.CfnUserPool.__name__), admin_create_user_config=cognito.CfnUserPool.AdminCreateUserConfigProperty( allow_admin_create_user_only=False), account_recovery_setting=cognito.CfnUserPool.AccountRecoverySettingProperty( recovery_mechanisms=[cognito.CfnUserPool.RecoveryOptionProperty( name='verified_email', priority=1), cognito.CfnUserPool.RecoveryOptionProperty( name='verified_phone_number', priority=2)]), auto_verified_attributes=['email', 'phone_number'], enabled_mfas=['SMS_MFA'], mfa_configuration='OPTIONAL', sms_configuration=cognito.CfnUserPool.SmsConfigurationProperty( external_id=name_utils.format_aws_resource_name(feature_name, project_name, env, cognito.CfnUserPool.__name__) + '-external', sns_caller_arn=sms_role.get_role().role_arn)) self._user_pool.node.add_dependency(sms_role.get_role()) self._user_pool_client \ = cognito.CfnUserPoolClient(scope, name_utils.format_aws_resource_id(feature_name, project_name, env, cognito.CfnUserPoolClient.__name__), client_name=name_utils.format_aws_resource_name(feature_name, project_name, env, cognito.CfnUserPoolClient.__name__), user_pool_id=self._user_pool.ref, explicit_auth_flows=['ALLOW_ADMIN_USER_PASSWORD_AUTH', 'ALLOW_CUSTOM_AUTH', 'ALLOW_USER_PASSWORD_AUTH', 'ALLOW_USER_SRP_AUTH', 'ALLOW_REFRESH_TOKEN_AUTH'], # access_token_validity=5, # Does not work # id_token_validity=5, # Does not work # refresh_token_validity=30, # Does not work ) self._user_pool_client.add_depends_on(self._user_pool) CfnOutput( scope, 'CognitoUserPoolId', description="Cognito User pool id", value=self._user_pool.ref) CfnOutput( scope, 'CognitoUserPoolAppClientId', description="Cognito User pool App client id", value=self._user_pool_client.ref) def get_user_pool(self) -> cognito.CfnUserPool: """ :return: Cognito user pool """ return self._user_pool def get_user_pool_client(self) -> cognito.CfnUserPoolClient: """ :return: Cognito user pool client. """ return self._user_pool_client def create_using_higher_construct(self): raise NotImplemented('Add implementation') # # Below does not work as Creating App client without refresh tokens auth flow param is not accepted by CF. # # Create Cognito user pool # user_pool = cognito.UserPool(scope, # id=name_utils.format_aws_resource_id(stack_feature_name, project_name, env, # cognito.UserPool.__name__), # user_pool_name=name_utils.format_aws_resource_name(stack_feature_name, # project_name, env, # cognito.UserPool.__name__), # mfa=cognito.Mfa.OPTIONAL, # mfa_second_factor=cognito.MfaSecondFactor(otp=False, sms=True), # enable_sms_role=True, # sms_role=sms_role.get_role(), # sms_role_external_id='c87467be-4f34-11ea-b77f-2e728ce88125', # self_sign_up_enabled=True) # # user_pool_client = user_pool.add_client( # name_utils.format_aws_resource_id(stack_feature_name, project_name, env, # cognito.UserPoolClient.__name__), # # access_token_validity=core.Duration.minutes(6), # auth_flows=cognito.AuthFlow(admin_user_password=True), # # id_token_validity=core.Duration.minutes(6), # user_pool_client_name=name_utils.format_aws_resource_name(stack_feature_name, project_name, env, # cognito.UserPoolClient.__name__), # disable_o_auth=True)

Gems/AWSClientAuth/cdk/cognito/cognito_user_pool.py (65 lines of code) (raw):