rg_userpool.yml

AWSTemplateFormatVersion: "2010-09-09"
Metadata:
  Generator: "former2"
Description: ""
Parameters:
  UserPoolNameParam:
    Description: The name of the CognitoUserPool
    Type: String
    MinLength: 4
    MaxLength: 32
    Default: MyResearchGatewayUserPool
    ConstraintDescription: A short name to identify this CognitoUserPool
  ClientNameParam:
    Description: The name of the ClientName
    Type: String
    MinLength: 4
    MaxLength: 32
    Default: MyResearchGatewayInstance
    ConstraintDescription: A short name to identify the client connecting to the CognitoUserPool
  PortalURLParam:
    Description: The URL for the instance being setup
    Type: String
    MinLength: 16
    MaxLength: 256
    ConstraintDescription: "The URL at which this instance of Research Gateway will be available to the user"
  Function1Name:
    Description: Function Name for Lambda function called post-verification.
    Type: String
    MinLength: 4
    MaxLength: 64
    Default: UserManagementAfterSuccessSignup
    ConstraintDescription: A Name to identify LambdaFunction1
  Function2Name:
    Description: Function Name for lambda which handles pre-verification custom message.
    Type: String
    MinLength: 4
    MaxLength: 64
    Default: UserManagement
    ConstraintDescription: A Name to identify LambdaFunction2
  CFTBucketName:
    Description: Bucket that is created to hold CFT templates used by Research Gateway
    Type: String
    Default: ""
    ConstraintDescription: Bucket Name
Resources:
  UserPoolCustomMessageLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:invokeFunction
      Principal: cognito-idp.amazonaws.com
      FunctionName: !Ref LambdaFunction2
      SourceArn:
        Fn::Sub: arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${CognitoUserPool}
  UserPoolPostConfirmationLambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:invokeFunction
      Principal: cognito-idp.amazonaws.com
      FunctionName: !Ref LambdaFunction1
      SourceArn:
        Fn::Sub: arn:aws:cognito-idp:${AWS::Region}:${AWS::AccountId}:userpool/${CognitoUserPool}
  CognitoUserPool:
    Type: "AWS::Cognito::UserPool"
    Properties:
      UserPoolName: !Ref "UserPoolNameParam"
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireUppercase: true
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          TemporaryPasswordValidityDays: 90
      LambdaConfig:
        CustomMessage: !GetAtt LambdaFunction2.Arn
        PostConfirmation: !GetAtt LambdaFunction1.Arn
      Schema:
        - Name: "sub"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: false
          Required: true
          StringAttributeConstraints:
            MinLength: "1"
            MaxLength: "2048"
        - Name: "name"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "given_name"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "family_name"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "middle_name"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "nickname"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "preferred_username"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "profile"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "picture"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "website"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "email"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: true
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "email_verified"
          AttributeDataType: "Boolean"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
        - Name: "gender"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "birthdate"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "10"
            MaxLength: "10"
        - Name: "zoneinfo"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "locale"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "phone_number"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "address"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "0"
            MaxLength: "2048"
        - Name: "updated_at"
          AttributeDataType: "Number"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          NumberAttributeConstraints:
            MinValue: "0"
        - Name: "created_by"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "1"
            MaxLength: "256"
        - Name: "user"
          AttributeDataType: "String"
          DeveloperOnlyAttribute: false
          Mutable: true
          Required: false
          StringAttributeConstraints:
            MinLength: "1"
            MaxLength: "256"
      AutoVerifiedAttributes:
        - "email"
      AliasAttributes:
        - "preferred_username"
        - "email"
      SmsVerificationMessage: "Your verification code is {####}. "
      EmailVerificationMessage: "Your verification code is {####}. "
      EmailVerificationSubject: "Your verification code"
      SmsAuthenticationMessage: "Your authentication code is {####}. "
      MfaConfiguration: "OFF"
      EmailConfiguration:
        EmailSendingAccount: "COGNITO_DEFAULT"
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: false
        InviteMessageTemplate:
          SMSMessage: "Your username is {username} and temporary password is {####}. "
          EmailMessage: "Your username is {username} and temporary password is {####}. "
          EmailSubject: "Your temporary password"
      UserPoolTags:
        RLgroup: ""
      AccountRecoverySetting:
        RecoveryMechanisms:
          - Priority: 1
            Name: "verified_email"
          - Priority: 2
            Name: "verified_phone_number"
      UsernameConfiguration:
        CaseSensitive: true
      VerificationMessageTemplate:
        SmsMessage: "Your verification code is {####}. "
        EmailMessage: "Your verification code is {####}. "
        EmailSubject: "Your verification code"
        DefaultEmailOption: "CONFIRM_WITH_CODE"

  CognitoUserPoolClient:
    Type: "AWS::Cognito::UserPoolClient"
    Properties:
      UserPoolId: !Ref CognitoUserPool
      ClientName: !Ref ClientNameParam
      RefreshTokenValidity: 30
      ReadAttributes:
        - "address"
        - "birthdate"
        - "email"
        - "email_verified"
        - "family_name"
        - "gender"
        - "given_name"
        - "locale"
        - "middle_name"
        - "name"
        - "nickname"
        - "phone_number"
        - "picture"
        - "preferred_username"
        - "profile"
        - "updated_at"
        - "website"
        - "zoneinfo"
        - "custom:created_by"
        - "custom:user"
      WriteAttributes:
        - "address"
        - "birthdate"
        - "email"
        - "family_name"
        - "gender"
        - "given_name"
        - "locale"
        - "middle_name"
        - "name"
        - "nickname"
        - "phone_number"
        - "picture"
        - "preferred_username"
        - "profile"
        - "updated_at"
        - "website"
        - "zoneinfo"
        - "custom:created_by"
        - "custom:user"
      ExplicitAuthFlows:
        - "ALLOW_ADMIN_USER_PASSWORD_AUTH"
        - "ALLOW_CUSTOM_AUTH"
        - "ALLOW_REFRESH_TOKEN_AUTH"
        - "ALLOW_USER_PASSWORD_AUTH"
        - "ALLOW_USER_SRP_AUTH"
      PreventUserExistenceErrors: "LEGACY"

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - logs:*
                Resource: arn:aws:logs:*:*:*
  LambdaFunction1:
    Type: "AWS::Lambda::Function"
    Properties:
      Description: "This trigger is invoked after a user is confirmed, allowing you to send custom messages or to add custom logic, for example for analytics."
      Environment:
        Variables:
          PORTAL_LINK: !Ref PortalURLParam
      FunctionName: !Ref Function1Name
      Handler: "index.handler"
      Code:
        S3Bucket: !Ref CFTBucketName
        S3Key: post_verification_send_message.zip
      Role: !GetAtt "LambdaExecutionRole.Arn"
      MemorySize: 128
      Runtime: "nodejs18.x"
      Timeout: 3
      TracingConfig:
        Mode: "PassThrough"

  LambdaFunction2:
    Type: "AWS::Lambda::Function"
    Properties:
      Description: "This trigger is invoked before a verification or MFA message is sent, allowing you to customize the message dynamically."
      Environment:
        Variables:
          PORTAL_LINK: !Ref PortalURLParam
      FunctionName: !Ref Function2Name
      Handler: "index.handler"
      Code:
        S3Bucket: !Ref CFTBucketName
        S3Key: pre_verification_custom_message.zip
      Role: !GetAtt "LambdaExecutionRole.Arn"
      MemorySize: 128
      Runtime: "nodejs18.x"
      Timeout: 3
      TracingConfig:
        Mode: "PassThrough"

Outputs:
  UserPoolId:
    Value: !Ref CognitoUserPool
  #    Export:
  #      Name: "CognitoUserPool::Id"
  UserPoolClientId:
    Value: !Ref CognitoUserPoolClient
#    Export:
#      Name: "CognitoUserPoolClient::Id"