[英]Cannot set a property of cognito userpool client via cloudformation
我正在尝试通过 cloudformation 运行 congnito 并且一切正常,但是 cognito 中有如下部分:
如您所见,有“启用身份提供商”部分,但我找不到可以将其设置为 cloudformation 中的 Cognito 用户池的位置!
我试过这个属性,但它说不支持。
SupportedIdentityProviders
这是我的用户池客户端代码:
UserPoolClient:
Type: "AWS::Cognito::UserPoolClient"
Properties:
ClientName: !Sub ${project}-client
ExplicitAuthFlows:
- ADMIN_NO_SRP_AUTH
- USER_PASSWORD_AUTH
GenerateSecret: false
UserPoolId: !Ref UserPool
RefreshTokenValidity: 30
这是我的用户池:
UserPool:
Type: "AWS::Cognito::UserPool"
Properties:
UserPoolName: !Sub ${project}-user-pool-test
AutoVerifiedAttributes:
- email
UsernameAttributes:
- email
MfaConfiguration: "OFF"
LambdaConfig:
CustomMessage:
Fn::ImportValue: !Sub ${project}-${EnvironmentApp}-lambda-cognito-custom-message-post
Policies:
PasswordPolicy:
MinimumLength: !Ref MinimumLength
RequireLowercase: !Ref RequireLowercase
RequireNumbers: !Ref RequireNumbers
RequireSymbols: !Ref RequireSymbols
RequireUppercase: !Ref RequireUppercase
Schema:
-
AttributeDataType: String
DeveloperOnlyAttribute: false
Mutable: true
Name: !Sub ${project}-stg
Required: false
-
AttributeDataType: String
DeveloperOnlyAttribute: false
Mutable: true
Name: !Sub zuora-stg
Required: false
-
AttributeDataType: String
DeveloperOnlyAttribute: false
Mutable: true
Name: !Sub salesforce-stg
Required: false
是否支持云形成? 我很感激任何帮助?
正如其他答案所暗示的那样,到目前为止,这还不能在 CloudFormation 本机中完成。 但是,正如 ASR 回答所建议的那样,可以通过 CloudFormation 自定义资源来实现。
我的雇主已开源其自定义资源集合,包括CognitoUserPool和CognitoDomainName ( CloudFormation也不支持)。 自定义资源源码可以在github上找到
以下是有关设置的手动说明 - 您始终可以通过在 CloudFormation 中放置自定义资源支持 Lambda 来进一步自动化操作。
以下所有命令均适用于 Mac。 您可能需要修改其他平台的 base64 标志
aws iam create-role --role-name LambdaRoleCognito --assume-role-policy-document '{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}'
aws iam attach-role-policy --role-name LambdaRoleCognito \
--policy-arn arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
aws iam attach-role-policy --role-name LambdaRoleCognito \
--policy-arn arn:aws:iam::aws:policy/AmazonCognitoPowerUser
wget https://github.com/base2Services/cloudformation-custom-resources-nodejs/releases/download/1.0.0/ccr-nodejs-1.0.0.zip
account_id=$(aws sts get-caller-identity --query Account --output text)
aws s3 mb s3://${account_id}.cfncustomres.source
aws s3 cp ccr-nodejs-1.0.0.zip s3://${account_id}.cfncustomres.source/ccr-nodejs-1.0.0.zip
aws lambda create-function --function-name CfnCrCognitUPC --runtime nodejs6.10 \
--role arn:aws:iam::${account_id}:role/LambdaRoleCognito \
--timeout 30 \
--memory-size 512 \
--code S3Bucket=${account_id}.cfncustomres.source,S3Key=ccr-nodejs-1.0.0.zip \
--handler cognito-user-pool-client/index.handler
aws lambda invoke --function-name CfnCrCognitUPC --payload '{
"StackId": "arn:aws:cloudformation:us-west-2:EXAMPLE/stack-name/guid",
"ResponseURL": "http://pre-signed-S3-url-for-response",
"ResourceProperties": {
"ClientName": "MyCCRCreatedUP",
"SupportedIdentityProviders": [
"COGNITO"
],
"UserPoolId":"!! REPLACE WITH YOUR USER POOL ID !!"
},
"RequestType": "Create",
"ResourceType": "Custom::TestResource",
"RequestId": "unique id for this create request",
"LogicalResourceId": "MyTestResource"
}' --log-type Tail --invocation-type RequestResponse output.txt --query LogResult --output text | base64 -D
有关所有支持的属性的列表,请查看自定义资源 JSON 架构
Resources:
MyPoolApplication:
Type: Custom::CognitoUserPool
Properties:
ServiceToken: arn:aws:lambda:<<REPLACE_WITH_YOUR_REGION>>:<<REPLACE_WITH_YOUR_ACCOUNT_ID>>:function:CfnCrCognitUPC
ClientName: ApplicationClientNameHere
UserPoolId:
Ref: UserPool
SupportedIdentityProviders:
- COGNITO
.... other support properties ....
我上个月遇到了同样的问题。 CFN 尚不支持此属性。 所以我最终使用 CFN 自定义资源来创建池客户端。 更多关于CFN 自定义资源的信息。 本质上,我让 CFN 调用 Lambda 函数来创建用户池客户端(SDK 支持所有属性)。
正如 ASR 所说,Cloudformation 似乎尚不支持此功能。
我们最终尝试了 Terraform - 它确实支持它,例如
resource "aws_cognito_user_pool_client" "my_client" {
...
supported_identity_providers = ["COGNITO"]
}
我们现在已将所有内容切换为使用 terraform,因为它比 Cloudformation 更易于理解、阅读和编写。
我知道这可能不是您想要的答案,但我希望它有所帮助。
截至2019 年 10 月, cognito 资源现在由 cloudformation 支持。 资源是使用 AWS::Cognito::UserPool、AWS::Cognito::UserPoolClient、AWS::Cognito::UserPoolDomain 等预期类型创建的。
要启用身份提供者,需要设置以下相关的 CF 属性。
UserPoolClient:
Type: AWS::Cognito::UserPoolClient
UserPoolId: !Ref UserPool
SupportedIdentityProviders:
- COGNITO
- Facebook
- Google
- LoginWithAmazon
...
cloudformation 的文档可在此处获得。
正如其他答案所述,现在有一种使用 CloudFormation 设置 UserPoolClient 的方法,但是我来到这个问题寻找具体示例,因为我在一些参数方面遇到了困难。 我想把它放在这里,以防万一有人也在寻找一个例子。
在我的示例中,我还包含了与 google 的联合登录,以使其更加完整。 如果您不想使用 google 登录,只需将其从SupportedIdentityProviders
删除即可。
模板如下:
AWSTemplateFormatVersion: 2010-09-09
Parameters:
envParameter:
Type: String
Default: dev
AllowedValues: [ dev, staging, prod ]
Description: Suffix to be added for names.
Resources:
myUserPool:
DependsOn: [ cognitoSMSRole ]
Type: AWS::Cognito::UserPool
Properties:
AccountRecoverySetting:
RecoveryMechanisms:
- Name: verified_email
Priority: 1
- Name: verified_phone_number
Priority: 2
AdminCreateUserConfig:
AllowAdminCreateUserOnly: False
AutoVerifiedAttributes:
- phone_number
EnabledMfas:
- SMS_MFA
MfaConfiguration: OPTIONAL
Policies:
PasswordPolicy:
MinimumLength: 8
RequireLowercase: True
RequireNumbers: True
RequireSymbols: True
RequireUppercase: True
TemporaryPasswordValidityDays: 7
Schema:
- AttributeDataType: String
DeveloperOnlyAttribute: False
Mutable: False
Name: name
Required: True
- AttributeDataType: String
DeveloperOnlyAttribute: False
Mutable: False
Name: last_name
Required: False
SmsConfiguration:
ExternalId: !Sub cognito-sms-role-${envParameter}
SnsCallerArn: !GetAtt cognitoSMSRole.Arn
UsernameAttributes:
- phone_number
UsernameConfiguration:
CaseSensitive: False
UserPoolName: !Sub UserPool-${envParameter}
cognitoSMSRole:
Type: "AWS::IAM::Role"
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Service:
- "cognito-idp.amazonaws.com"
Action:
- "sts:AssumeRole"
Policies:
- PolicyName: "CognitoSNSPolicy"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Action: "sns:publish"
Resource: "*"
cognitoClient:
DependsOn: [ myUserPool, googleProvider ]
Type: AWS::Cognito::UserPoolClient
Properties:
AllowedOAuthFlows:
- code
- implicit
AllowedOAuthFlowsUserPoolClient: True
AllowedOAuthScopes:
- email
- openid
- profile
CallbackURLs:
- http://google.co.uk
ClientName: !Sub cognito-appid-${envParameter}
GenerateSecret: False
LogoutURLs:
- http://google.co.uk
PreventUserExistenceErrors: ENABLED
RefreshTokenValidity: 1
SupportedIdentityProviders:
- COGNITO
- Google
UserPoolId: !Ref myUserPool
googleProvider:
DependsOn: [ myUserPool ]
Type: AWS::Cognito::UserPoolIdentityProvider
Properties:
AttributeMapping:
name: emailAddress
sub: Username
ProviderDetails:
client_id: client_id.apps.googleusercontent.com
client_secret: this_is_the_client_secret
authorize_scopes: email openid profile
ProviderName: Google
ProviderType: Google
UserPoolId: !Ref myUserPool
Outputs:
userPool:
Description: "User pool ID"
Value: !Ref myUserPool
identityPool:
Description: "Identity pool ID"
Value: !Ref cognitoClient
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.