Skip to content

Commit 9cc9bd3

Browse files
watany-devwatany-dev
authored
feat(cognito): add new AdvancedSecurityMode property (#23261)
fixes #7405 https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html#cfn-cognito-userpool-userpooladdons https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-userpooladdons.html#cfn-cognito-userpool-userpooladdons-advancedsecuritymode We refer to the following suspended PRs #17923 ---- ### All Submissions: * [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Construct Runtime Dependencies: * [ ] This PR adds new construct runtime dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-construct-runtime-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 4e7fdae commit 9cc9bd3

File tree

10 files changed

+201
-113
lines changed

10 files changed

+201
-113
lines changed

Diff for: ‎packages/@aws-cdk/aws-cognito/README.md

+10
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,16 @@ new cognito.UserPool(this, 'UserPool', {
356356
The default for account recovery is by phone if available and by email otherwise.
357357
A user will not be allowed to reset their password via phone if they are also using it for MFA.
358358

359+
#### Advanced Security Mode
360+
361+
User pools can be configured to use Advanced security. You can turn the user pool advanced security features on, and customize the actions that are taken in response to different risks. Or you can use audit mode to gather metrics on detected risks without taking action. In audit mode, the advanced security features publish metrics to Amazon CloudWatch. See the [documentation on Advanced security](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-advanced-security.html) to learn more.
362+
363+
```ts
364+
new cognito.UserPool(this, 'myuserpool', {
365+
// ...
366+
advancedSecurityMode: cognito.AdvancedSecurityMode.ENFORCED,
367+
});
368+
```
359369

360370
### Emails
361371

Diff for: ‎packages/@aws-cdk/aws-cognito/lib/user-pool.ts

+22
Original file line numberDiff line numberDiff line change
@@ -496,6 +496,19 @@ export interface DeviceTracking {
496496
readonly deviceOnlyRememberedOnUserPrompt: boolean;
497497
}
498498

499+
/**
500+
* The different ways in which a user pool's Advanced Security Mode can be configured.
501+
* @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-userpooladdons.html#cfn-cognito-userpool-userpooladdons-advancedsecuritymode
502+
*/
503+
export enum AdvancedSecurityMode {
504+
/** Enable advanced security mode */
505+
ENFORCED = 'ENFORCED',
506+
/** gather metrics on detected risks without taking action. Metrics are published to Amazon CloudWatch */
507+
AUDIT = 'AUDIT',
508+
/** Advanced security mode is disabled */
509+
OFF = 'OFF'
510+
}
511+
499512
/**
500513
* Props for the UserPool construct
501514
*/
@@ -692,6 +705,12 @@ export interface UserPoolProps {
692705
* @default - no key ID configured
693706
*/
694707
readonly customSenderKmsKey?: IKey;
708+
709+
/**
710+
* The user pool's Advanced Security Mode
711+
* @default - no value
712+
*/
713+
readonly advancedSecurityMode?: AdvancedSecurityMode;
695714
}
696715

697716
/**
@@ -934,6 +953,9 @@ export class UserPool extends UserPoolBase {
934953
emailVerificationSubject,
935954
smsVerificationMessage,
936955
verificationMessageTemplate,
956+
userPoolAddOns: undefinedIfNoKeys({
957+
advancedSecurityMode: props.advancedSecurityMode,
958+
}),
937959
schema: this.schemaConfiguration(props),
938960
mfaConfiguration: props.mfa,
939961
enabledMfas: this.mfaConfiguration(props),

Diff for: ‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-explicit-props.js.snapshot/cdk.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"version":"21.0.0"}
1+
{"version":"22.0.0"}

Diff for: ‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-explicit-props.js.snapshot/integ-user-pool.assets.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
{
2-
"version": "21.0.0",
2+
"version": "22.0.0",
33
"files": {
4-
"7df3ca05ace569184cc645d485b05885dc2e13f745606873a57afa9d264ecc08": {
4+
"d52bd1bc71dfc61d4ad7024fe0716269f71e86ea085d0ccd71bcbe68e8df1c34": {
55
"source": {
66
"path": "integ-user-pool.template.json",
77
"packaging": "file"
88
},
99
"destinations": {
1010
"current_account-current_region": {
1111
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12-
"objectKey": "7df3ca05ace569184cc645d485b05885dc2e13f745606873a57afa9d264ecc08.json",
12+
"objectKey": "d52bd1bc71dfc61d4ad7024fe0716269f71e86ea085d0ccd71bcbe68e8df1c34.json",
1313
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
1414
}
1515
}

Diff for: ‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-explicit-props.js.snapshot/integ-user-pool.template.json

+3
Original file line numberDiff line numberDiff line change
@@ -905,6 +905,9 @@
905905
"phone_number"
906906
]
907907
},
908+
"UserPoolAddOns": {
909+
"AdvancedSecurityMode": "ENFORCED"
910+
},
908911
"UserPoolName": "MyUserPool",
909912
"VerificationMessageTemplate": {
910913
"DefaultEmailOption": "CONFIRM_WITH_CODE",

Diff for: ‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-explicit-props.js.snapshot/integ.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "21.0.0",
2+
"version": "22.0.0",
33
"testCases": {
44
"integ.user-pool-explicit-props": {
55
"stacks": [

Diff for: ‎packages/@aws-cdk/aws-cognito/test/integ.user-pool-explicit-props.js.snapshot/manifest.json

+8-98
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
{
2-
"version": "21.0.0",
2+
"version": "22.0.0",
33
"artifacts": {
4-
"Tree": {
5-
"type": "cdk:tree",
6-
"properties": {
7-
"file": "tree.json"
8-
}
9-
},
104
"integ-user-pool.assets": {
115
"type": "cdk:asset-manifest",
126
"properties": {
@@ -23,7 +17,7 @@
2317
"validateOnSynth": false,
2418
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
2519
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26-
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/7df3ca05ace569184cc645d485b05885dc2e13f745606873a57afa9d264ecc08.json",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/d52bd1bc71dfc61d4ad7024fe0716269f71e86ea085d0ccd71bcbe68e8df1c34.json",
2721
"requiresBootstrapStackVersion": 6,
2822
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
2923
"additionalDependencies": [
@@ -260,99 +254,15 @@
260254
"type": "aws:cdk:logicalId",
261255
"data": "CheckBootstrapVersion"
262256
}
263-
],
264-
"createAuthChallengeCreateAuthChallengeCognito57E2297E": [
265-
{
266-
"type": "aws:cdk:logicalId",
267-
"data": "createAuthChallengeCreateAuthChallengeCognito57E2297E",
268-
"trace": [
269-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
270-
]
271-
}
272-
],
273-
"customMessageCustomMessageCognitoB4F894A6": [
274-
{
275-
"type": "aws:cdk:logicalId",
276-
"data": "customMessageCustomMessageCognitoB4F894A6",
277-
"trace": [
278-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
279-
]
280-
}
281-
],
282-
"defineAuthChallengeDefineAuthChallengeCognito4DBD8021": [
283-
{
284-
"type": "aws:cdk:logicalId",
285-
"data": "defineAuthChallengeDefineAuthChallengeCognito4DBD8021",
286-
"trace": [
287-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
288-
]
289-
}
290-
],
291-
"postAuthenticationPostAuthenticationCognito8B923BC3": [
292-
{
293-
"type": "aws:cdk:logicalId",
294-
"data": "postAuthenticationPostAuthenticationCognito8B923BC3",
295-
"trace": [
296-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
297-
]
298-
}
299-
],
300-
"postConfirmationPostConfirmationCognito9D010393": [
301-
{
302-
"type": "aws:cdk:logicalId",
303-
"data": "postConfirmationPostConfirmationCognito9D010393",
304-
"trace": [
305-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
306-
]
307-
}
308-
],
309-
"preAuthenticationPreAuthenticationCognito67FACB54": [
310-
{
311-
"type": "aws:cdk:logicalId",
312-
"data": "preAuthenticationPreAuthenticationCognito67FACB54",
313-
"trace": [
314-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
315-
]
316-
}
317-
],
318-
"preSignUpPreSignUpCognitoE986CC53": [
319-
{
320-
"type": "aws:cdk:logicalId",
321-
"data": "preSignUpPreSignUpCognitoE986CC53",
322-
"trace": [
323-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
324-
]
325-
}
326-
],
327-
"preTokenGenerationPreTokenGenerationCognitoC1959918": [
328-
{
329-
"type": "aws:cdk:logicalId",
330-
"data": "preTokenGenerationPreTokenGenerationCognitoC1959918",
331-
"trace": [
332-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
333-
]
334-
}
335-
],
336-
"userMigrationUserMigrationCognito29EEC4AD": [
337-
{
338-
"type": "aws:cdk:logicalId",
339-
"data": "userMigrationUserMigrationCognito29EEC4AD",
340-
"trace": [
341-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
342-
]
343-
}
344-
],
345-
"verifyAuthChallengeResponseVerifyAuthChallengeResponseCognito9DC48AFC": [
346-
{
347-
"type": "aws:cdk:logicalId",
348-
"data": "verifyAuthChallengeResponseVerifyAuthChallengeResponseCognito9DC48AFC",
349-
"trace": [
350-
"!!DESTRUCTIVE_CHANGES: WILL_DESTROY"
351-
]
352-
}
353257
]
354258
},
355259
"displayName": "integ-user-pool"
260+
},
261+
"Tree": {
262+
"type": "cdk:tree",
263+
"properties": {
264+
"file": "tree.json"
265+
}
356266
}
357267
}
358268
}

0 commit comments

Comments
 (0)