cf.yml

AWSTemplateFormatVersion: 2010-09-09
Resources:
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: example-pool
      UsernameAttributes:
        - email
      AutoVerifiedAttributes:
        - email
      Policies:
        PasswordPolicy:
          MinimumLength: 6
          RequireLowercase: true
          RequireNumbers: false
          RequireSymbols: false
          RequireUppercase: true
          TemporaryPasswordValidityDays: 7

  CognitoUserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: example-domain
      UserPoolId:
        Ref: CognitoUserPool

  # CognitoUserPoolFacebookProvider:
  #   Type: AWS::Cognito::UserPoolIdentityProvider
  #   Properties:
  #     AttributeMapping:
  #       email: email
  #       name: name
  #       picture: picture
  #       username: id
  #     ProviderDetails:
  #       client_id: <client_id>
  #       client_secret: <client_secret>
  #       authorize_scopes: <public_profile,email>
  #     ProviderName: Facebook
  #     ProviderType: Facebook
  #     UserPoolId:
  #       Ref: CognitoUserPool

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      ClientName: example-user-pool-client
      AllowedOAuthFlows:
        - code
        - implicit
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthScopes:
        - phone
        - email
        - openid
        - profile
        - aws.cognito.signin.user.admin
      CallbackURLs:
        - http://localhost:3000/
      LogoutURLs:
        - http://localhost:3000/
      PreventUserExistenceErrors: LEGACY
      UserPoolId:
        Ref: CognitoUserPool
      ExplicitAuthFlows:
        - ADMIN_NO_SRP_AUTH
      GenerateSecret: false
      SupportedIdentityProviders:
        - COGNITO

  CognitoIdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      IdentityPoolName: example-identity-pool
      AllowUnauthenticatedIdentities: false
      CognitoIdentityProviders:
        - ClientId:
            Ref: CognitoUserPoolClient
          ProviderName:
            Fn::GetAtt: ["CognitoUserPool", "ProviderName"]

  CognitoIdentityPoolRoles:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId:
        Ref: CognitoIdentityPool
      Roles:
        authenticated:
          Fn::GetAtt: [CognitoAuthRole, Arn]

  CognitoAuthRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Federated: "cognito-identity.amazonaws.com"
            Action:
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud":
                  Ref: CognitoIdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": authenticated
      Policies:
        - PolicyName: "CognitoAuthorizedPolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                  - "cognito-identity:*"
                Resource: "*"

Outputs:
  UserPoolId:
    Value:
      Ref: CognitoUserPool
    Export:
      Name: UserPoolId

  UserPoolDomain:
    Value:
      Ref: CognitoUserPoolDomain
    Export:
      Name: UserPoolDomain

  UserPoolClientId:
    Value:
      Ref: CognitoUserPoolClient
    Export:
      Name: UserPoolClientId

  IdentityPoolId:
    Value:
      Ref: CognitoIdentityPool
    Export:
      Name: IdentityPoolId

  CognitoAuthRole:
    Value:
      Ref: CognitoAuthRole
    Export:
      Name: CognitoAuthRole