Skip to content

Commit 9bde9f3

Browse files
jogoldjogold
authored
feat(cognito): deletion protection for user pools (#22765)
Add the `deletionProtection` property to enable deletion protection on a user pool. ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent dfcfb8d commit 9bde9f3

File tree

10 files changed

+67
-15
lines changed

10 files changed

+67
-15
lines changed

‎packages/@aws-cdk/aws-cognito/README.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aw
5353
- [App Clients](#app-clients)
5454
- [Resource Servers](#resource-servers)
5555
- [Domains](#domains)
56+
- [Deletion protection](#deletion-protection)
5657

5758
## User Pools
5859

@@ -869,3 +870,16 @@ Existing domains can be imported into CDK apps using `UserPoolDomain.fromDomainN
869870
```ts
870871
const myUserPoolDomain = cognito.UserPoolDomain.fromDomainName(this, 'my-user-pool-domain', 'domain-name');
871872
```
873+
874+
### Deletion protection
875+
876+
Deletion protection can be enabled on a user pool to prevent accidental deletion:
877+
878+
```ts
879+
const userpool = new cognito.UserPool(this, 'UserPool', {
880+
// ...
881+
deletionProtection: true,
882+
});
883+
```
884+
885+
By default deletion protection is disabled.

‎packages/@aws-cdk/aws-cognito/lib/user-pool.ts

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -673,6 +673,13 @@ export interface UserPoolProps {
673673
*/
674674
readonly removalPolicy?: RemovalPolicy;
675675

676+
/**
677+
* Indicates whether the user pool should have deletion protection enabled.
678+
*
679+
* @default false
680+
*/
681+
readonly deletionProtection?: boolean;
682+
676683
/**
677684
* Device tracking settings
678685
* @default - see defaults on each property of DeviceTracking.
@@ -938,6 +945,7 @@ export class UserPool extends UserPoolBase {
938945
accountRecoverySetting: this.accountRecovery(props),
939946
deviceConfiguration: props.deviceTracking,
940947
userAttributeUpdateSettings: this.configureUserAttributeChanges(props),
948+
deletionProtection: defaultDeletionProtection(props.deletionProtection),
941949
});
942950
userPool.applyRemovalPolicy(props.removalPolicy);
943951

@@ -1279,3 +1287,15 @@ function undefinedIfNoKeys(struct: object): object | undefined {
12791287
function encodePuny(input: string | undefined): string | undefined {
12801288
return input !== undefined ? punycodeEncode(input) : input;
12811289
}
1290+
1291+
function defaultDeletionProtection(deletionProtection?: boolean): 'ACTIVE' | 'INACTIVE' | undefined {
1292+
if (deletionProtection === true) {
1293+
return 'ACTIVE';
1294+
}
1295+
1296+
if (deletionProtection === false) {
1297+
return 'INACTIVE';
1298+
}
1299+
1300+
return undefined;
1301+
}

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool.js.snapshot/cdk.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"20.0.0"}
1+
{"version":"21.0.0"}

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool.js.snapshot/integ-user-pool.assets.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"files": {
4-
"74ea2c843421df9c10c1481ddd7217c95f27e17517f1937cdcf1377dfd6c25c1": {
4+
"c804fbf067be5d847ab7df1eb55d6fa733f513f3908b0162773c8912e08695b1": {
55
"source": {
66
"path": "integ-user-pool.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "74ea2c843421df9c10c1481ddd7217c95f27e17517f1937cdcf1377dfd6c25c1.json",
12+
"objectKey": "c804fbf067be5d847ab7df1eb55d6fa733f513f3908b0162773c8912e08695b1.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool.js.snapshot/integ-user-pool.template.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
"AdminCreateUserConfig": {
1919
"AllowAdminCreateUserOnly": true
2020
},
21+
"DeletionProtection": "INACTIVE",
2122
"EmailVerificationMessage": "The verification code to your new account is {####}",
2223
"EmailVerificationSubject": "Verify your new account",
2324
"SmsVerificationMessage": "The verification code to your new account is {####}",

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool.js.snapshot/integ.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"testCases": {
44
"integ.user-pool": {
55
"stacks": [

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool.js.snapshot/manifest.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"artifacts": {
44
"Tree": {
55
"type": "cdk:tree",
@@ -23,7 +23,7 @@
2323
"validateOnSynth": false,
2424
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2525
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/74ea2c843421df9c10c1481ddd7217c95f27e17517f1937cdcf1377dfd6c25c1.json",
26+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/c804fbf067be5d847ab7df1eb55d6fa733f513f3908b0162773c8912e08695b1.json",
2727
"requiresBootstrapStackVersion": 6,
2828
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2929
"additionalDependencies": [

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool.js.snapshot/tree.json

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"path": "Tree",
1010
"constructInfo": {
1111
"fqn": "constructs.Construct",
12-
"version": "10.1.85"
12+
"version": "10.1.140"
1313
}
1414
},
1515
"integ-user-pool": {
@@ -41,6 +41,7 @@
4141
"adminCreateUserConfig": {
4242
"allowAdminCreateUserOnly": true
4343
},
44+
"deletionProtection": "INACTIVE",
4445
"emailVerificationMessage": "The verification code to your new account is {####}",
4546
"emailVerificationSubject": "Verify your new account",
4647
"smsVerificationMessage": "The verification code to your new account is {####}",
@@ -68,20 +69,20 @@
6869
"id": "user-pool-id",
6970
"path": "integ-user-pool/user-pool-id",
7071
"constructInfo": {
71-
"fqn": "constructs.Construct",
72-
"version": "10.1.85"
72+
"fqn": "@aws-cdk/core.CfnOutput",
73+
"version": "0.0.0"
7374
}
7475
}
7576
},
7677
"constructInfo": {
77-
"fqn": "constructs.Construct",
78-
"version": "10.1.85"
78+
"fqn": "@aws-cdk/core.Stack",
79+
"version": "0.0.0"
7980
}
8081
}
8182
},
8283
"constructInfo": {
83-
"fqn": "constructs.Construct",
84-
"version": "10.1.85"
84+
"fqn": "@aws-cdk/core.App",
85+
"version": "0.0.0"
8586
}
8687
}
8788
}

‎packages/@aws-cdk/aws-cognito/test/integ.user-pool.ts

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@ const stack = new Stack(app, 'integ-user-pool');
77
const userpool = new UserPool(stack, 'myuserpool', {
88
userPoolName: 'MyUserPool',
99
removalPolicy: RemovalPolicy.DESTROY,
10+
deletionProtection: false,
1011
});
1112

1213
new CfnOutput(stack, 'user-pool-id', {
1314
value: userpool.userPoolId,
14-
});
15+
});

‎packages/@aws-cdk/aws-cognito/test/user-pool.test.ts

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1909,6 +1909,21 @@ test('grant', () => {
19091909

19101910
});
19111911

1912+
test('deletion protection', () => {
1913+
// GIVEN
1914+
const stack = new Stack();
1915+
1916+
// WHEN
1917+
new UserPool(stack, 'Pool', {
1918+
deletionProtection: true,
1919+
});
1920+
1921+
// THEN
1922+
Template.fromStack(stack).hasResourceProperties('AWS::Cognito::UserPool', {
1923+
DeletionProtection: 'ACTIVE',
1924+
});
1925+
});
1926+
19121927
function fooFunction(scope: Construct, name: string): lambda.IFunction {
19131928
return new lambda.Function(scope, name, {
19141929
functionName: name,

0 commit comments

Comments
 (0)