Amazon Cognito addon

[gio-somo]

Hello.

Has anyone tried setting Cognito as an addon for a frontend service?

Is this the way to go or should I just set/configure Cognito separately ?

Thanks for any advice.

[iamhopaul123]

Hello @gio-somo. For now we don't have any pattern to help you integrate Cognito with Copilot. However, it is possible to set Cognito as an addon for the service. You might find it helpful for this APIGW example which uses Cognito as well.

Also, would you mind to share with us your use cases for using Cognito as an addon? What does your infrastructure architecture look like? Thank you!

[iamhopaul123]

I just tried to include Cognito as an addon with our Load balanced web service and it worked perfectly. Below is the addon template I use

Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The environment name your service, job, or workflow is being deployed to.
  Name:
    Type: String
    Description: The name of the service, job, or workflow being deployed.

Resources:
  MyUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: !Sub "${Name}.${Env}.${App}"

  UserPoolClient:
    Type: AWS::Cognito::UserPoolClient  
    DependsOn: UserPoolResourceServer
    Properties:
      ClientName: !Sub "${Name}.${Env}.${App}"
      GenerateSecret: false
      UserPoolId: !Ref MyUserPool
      SupportedIdentityProviders:
        - COGNITO
      ExplicitAuthFlows:
        - ALLOW_ADMIN_USER_PASSWORD_AUTH

  UserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: !Sub "${Name}-${Env}-${App}"
      UserPoolId: !Ref MyUserPool

  UserPoolResourceServer:
    Type: AWS::Cognito::UserPoolResourceServer
    Properties:
      UserPoolId: !Ref MyUserPool
      Identifier: !Sub "${Name}.${Env}.${App}"
      Name: !Sub "${Name}.${Env}.${App}"
      Scopes:
        - ScopeName: "api.readwrite"
          ScopeDescription: "All access"

  MyUserPoolPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: CognitoActions
            Effect: Allow
            Action:
              - "cognito-idp:*"
            Resource: "*"

Outputs:
  ClientId:
    Value: !Ref UserPoolClient
  UserpoolId:
    Value: !Ref MyUserPool
  MyUserPoolPolicyArn:
    Value: !Ref MyUserPoolPolicy

Note that if you want to turn on GenerateSecret to allow OAuth then you might need to inject the client secret as a secret and use secretHash in your app (see here).