Skip to content

Commit ea1436f

Browse files
badmintoncryerbadmintoncryer
authored
feat(cognito): v3.0 pre token generation trigger event (#33778)
### Issue # (if applicable) Closes #33733. ### Reason for this change AWS Cognito supports for [v3.0 pre token generation trigger event for machine-to-machine (M2M) client-credentials grants](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html). AWS CDK does not support this event version. ### Description of changes - Add `V3_0` to `LambdaVersion` - Add validation in the `addTrigger()` similar to what was implemented in V2.0 event. ### Describe any new or updated permissions being added None ### Description of how you validated changes Add both unit and integ tests ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 91a3076 commit ea1436f

12 files changed

+1162
-7
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-pre-token-generation.js.snapshot/PreTokenGenerationIntegTestDefaultTestDeployAssert5121EE60.assets.json

+19
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-pre-token-generation.js.snapshot/PreTokenGenerationIntegTestDefaultTestDeployAssert5121EE60.template.json

+36
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-pre-token-generation.js.snapshot/UserPoolPreTokenGenerationStack.assets.json

+19
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-pre-token-generation.js.snapshot/UserPoolPreTokenGenerationStack.template.json

+272
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,272 @@
1+
{
2+
"Resources": {
3+
"PreTokenGenerationLambdaServiceRole9DEA7D8A": {
4+
"Type": "AWS::IAM::Role",
5+
"Properties": {
6+
"AssumeRolePolicyDocument": {
7+
"Statement": [
8+
{
9+
"Action": "sts:AssumeRole",
10+
"Effect": "Allow",
11+
"Principal": {
12+
"Service": "lambda.amazonaws.com"
13+
}
14+
}
15+
],
16+
"Version": "2012-10-17"
17+
},
18+
"ManagedPolicyArns": [
19+
{
20+
"Fn::Join": [
21+
"",
22+
[
23+
"arn:",
24+
{
25+
"Ref": "AWS::Partition"
26+
},
27+
":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
28+
]
29+
]
30+
}
31+
]
32+
}
33+
},
34+
"PreTokenGenerationLambda1F82A453": {
35+
"Type": "AWS::Lambda::Function",
36+
"Properties": {
37+
"Code": {
38+
"ZipFile": "exports.handler = function(event, ctx, cb) { console.log(\"Mocked pre token generation\");return cb(null, \"success\"); }"
39+
},
40+
"Handler": "index.handler",
41+
"Role": {
42+
"Fn::GetAtt": [
43+
"PreTokenGenerationLambdaServiceRole9DEA7D8A",
44+
"Arn"
45+
]
46+
},
47+
"Runtime": "nodejs18.x"
48+
},
49+
"DependsOn": [
50+
"PreTokenGenerationLambdaServiceRole9DEA7D8A"
51+
]
52+
},
53+
"UserPoolV2AAED3EE9": {
54+
"Type": "AWS::Cognito::UserPool",
55+
"Properties": {
56+
"AccountRecoverySetting": {
57+
"RecoveryMechanisms": [
58+
{
59+
"Name": "verified_phone_number",
60+
"Priority": 1
61+
},
62+
{
63+
"Name": "verified_email",
64+
"Priority": 2
65+
}
66+
]
67+
},
68+
"AdminCreateUserConfig": {
69+
"AllowAdminCreateUserOnly": true
70+
},
71+
"EmailVerificationMessage": "The verification code to your new account is {####}",
72+
"EmailVerificationSubject": "Verify your new account",
73+
"LambdaConfig": {
74+
"PreTokenGenerationConfig": {
75+
"LambdaArn": {
76+
"Fn::GetAtt": [
77+
"PreTokenGenerationLambda1F82A453",
78+
"Arn"
79+
]
80+
},
81+
"LambdaVersion": "V2_0"
82+
}
83+
},
84+
"SmsVerificationMessage": "The verification code to your new account is {####}",
85+
"UserPoolTier": "PLUS",
86+
"VerificationMessageTemplate": {
87+
"DefaultEmailOption": "CONFIRM_WITH_CODE",
88+
"EmailMessage": "The verification code to your new account is {####}",
89+
"EmailSubject": "Verify your new account",
90+
"SmsMessage": "The verification code to your new account is {####}"
91+
}
92+
},
93+
"UpdateReplacePolicy": "Delete",
94+
"DeletionPolicy": "Delete"
95+
},
96+
"UserPoolV2PreTokenGenerationConfigCognito5CA259FE": {
97+
"Type": "AWS::Lambda::Permission",
98+
"Properties": {
99+
"Action": "lambda:InvokeFunction",
100+
"FunctionName": {
101+
"Fn::GetAtt": [
102+
"PreTokenGenerationLambda1F82A453",
103+
"Arn"
104+
]
105+
},
106+
"Principal": "cognito-idp.amazonaws.com",
107+
"SourceArn": {
108+
"Fn::GetAtt": [
109+
"UserPoolV2AAED3EE9",
110+
"Arn"
111+
]
112+
}
113+
}
114+
},
115+
"UserPoolV2ClientDF661186": {
116+
"Type": "AWS::Cognito::UserPoolClient",
117+
"Properties": {
118+
"AllowedOAuthFlows": [
119+
"implicit",
120+
"code"
121+
],
122+
"AllowedOAuthFlowsUserPoolClient": true,
123+
"AllowedOAuthScopes": [
124+
"profile",
125+
"phone",
126+
"email",
127+
"openid",
128+
"aws.cognito.signin.user.admin"
129+
],
130+
"CallbackURLs": [
131+
"https://example.com"
132+
],
133+
"ExplicitAuthFlows": [
134+
"ALLOW_USER_SRP_AUTH",
135+
"ALLOW_REFRESH_TOKEN_AUTH"
136+
],
137+
"SupportedIdentityProviders": [
138+
"COGNITO"
139+
],
140+
"UserPoolId": {
141+
"Ref": "UserPoolV2AAED3EE9"
142+
}
143+
}
144+
},
145+
"UserPoolV32089E007": {
146+
"Type": "AWS::Cognito::UserPool",
147+
"Properties": {
148+
"AccountRecoverySetting": {
149+
"RecoveryMechanisms": [
150+
{
151+
"Name": "verified_phone_number",
152+
"Priority": 1
153+
},
154+
{
155+
"Name": "verified_email",
156+
"Priority": 2
157+
}
158+
]
159+
},
160+
"AdminCreateUserConfig": {
161+
"AllowAdminCreateUserOnly": true
162+
},
163+
"EmailVerificationMessage": "The verification code to your new account is {####}",
164+
"EmailVerificationSubject": "Verify your new account",
165+
"LambdaConfig": {
166+
"PreTokenGenerationConfig": {
167+
"LambdaArn": {
168+
"Fn::GetAtt": [
169+
"PreTokenGenerationLambda1F82A453",
170+
"Arn"
171+
]
172+
},
173+
"LambdaVersion": "V3_0"
174+
}
175+
},
176+
"SmsVerificationMessage": "The verification code to your new account is {####}",
177+
"UserPoolTier": "PLUS",
178+
"VerificationMessageTemplate": {
179+
"DefaultEmailOption": "CONFIRM_WITH_CODE",
180+
"EmailMessage": "The verification code to your new account is {####}",
181+
"EmailSubject": "Verify your new account",
182+
"SmsMessage": "The verification code to your new account is {####}"
183+
}
184+
},
185+
"UpdateReplacePolicy": "Delete",
186+
"DeletionPolicy": "Delete"
187+
},
188+
"UserPoolV3PreTokenGenerationConfigCognitoA6B9795F": {
189+
"Type": "AWS::Lambda::Permission",
190+
"Properties": {
191+
"Action": "lambda:InvokeFunction",
192+
"FunctionName": {
193+
"Fn::GetAtt": [
194+
"PreTokenGenerationLambda1F82A453",
195+
"Arn"
196+
]
197+
},
198+
"Principal": "cognito-idp.amazonaws.com",
199+
"SourceArn": {
200+
"Fn::GetAtt": [
201+
"UserPoolV32089E007",
202+
"Arn"
203+
]
204+
}
205+
}
206+
},
207+
"UserPoolV3Client9E0EE7AD": {
208+
"Type": "AWS::Cognito::UserPoolClient",
209+
"Properties": {
210+
"AllowedOAuthFlows": [
211+
"implicit",
212+
"code"
213+
],
214+
"AllowedOAuthFlowsUserPoolClient": true,
215+
"AllowedOAuthScopes": [
216+
"profile",
217+
"phone",
218+
"email",
219+
"openid",
220+
"aws.cognito.signin.user.admin"
221+
],
222+
"CallbackURLs": [
223+
"https://example.com"
224+
],
225+
"ExplicitAuthFlows": [
226+
"ALLOW_USER_SRP_AUTH",
227+
"ALLOW_REFRESH_TOKEN_AUTH"
228+
],
229+
"SupportedIdentityProviders": [
230+
"COGNITO"
231+
],
232+
"UserPoolId": {
233+
"Ref": "UserPoolV32089E007"
234+
}
235+
}
236+
}
237+
},
238+
"Parameters": {
239+
"BootstrapVersion": {
240+
"Type": "AWS::SSM::Parameter::Value<String>",
241+
"Default": "/cdk-bootstrap/hnb659fds/version",
242+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
243+
}
244+
},
245+
"Rules": {
246+
"CheckBootstrapVersion": {
247+
"Assertions": [
248+
{
249+
"Assert": {
250+
"Fn::Not": [
251+
{
252+
"Fn::Contains": [
253+
[
254+
"1",
255+
"2",
256+
"3",
257+
"4",
258+
"5"
259+
],
260+
{
261+
"Ref": "BootstrapVersion"
262+
}
263+
]
264+
}
265+
]
266+
},
267+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
268+
}
269+
]
270+
}
271+
}
272+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-pre-token-generation.js.snapshot/cdk.out

+1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-pre-token-generation.js.snapshot/integ.json

+12
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)