cognito.yml

---
AWSTemplateFormatVersion: '2010-09-09'

# Parameters Section
Parameters:
  CognitoPoolName:
    Type: String
    Default: auth_pool
  DefaultClientName:
    Type: String
    Default: demoProject
  DefaultDomainName:
    Type: String
    Default: auth
  DefaultServerResourceServerName:
    Type: String
    Default: demo_project

# Resources section defines metadata for the Data Catalog
Resources:

  # Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html#cfn-cognito-userpool-userpoolname
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    DeletionPolicy: Retain
    Properties:
      UserPoolName: auth_pool
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          RequireUppercase: true
          TemporaryPasswordValidityDays: 7

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    # DependsOn: CognitoRenewalApiResourceServer
    Properties:
      UserPoolId: !Ref CognitoUserPool
      TokenValidityUnits: 
        AccessToken: hours
        IdToken: hours
        RefreshToken: days
      AccessTokenValidity: 4
      IdTokenValidity: 8
      RefreshTokenValidity: 1
      AllowedOAuthFlows:
        - client_credentials
      AllowedOAuthFlowsUserPoolClient: true
      # AllowedOAuthScopes: # You can add your custom scopes below
      #   - https://api.iorta.in/on-claim
      #   - https://api.iorta.in/on-payment
      #   - https://api.iorta.in/read
      #   - https://api.iorta.in/write
      ClientName: demoProject
      GenerateSecret: true

  CognitoUserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      # CustomDomainConfig: // Set this for custom domain & ssl config
      Domain: 
        Fn::Join:
          - "-"
          - - !Ref AWS::AccountId
            - !Ref DefaultDomainName
      UserPoolId: !Ref CognitoUserPool

  # CognitoRenewalApiResourceServer:
  #   Type: AWS::Cognito::UserPoolResourceServer
  #   Properties:
  #     Identifier: https://api.iorta.in
  #     Name: !Ref DefaultServerResourceServerName
  #     Scopes:
  #       - ScopeName: on-payment
  #         ScopeDescription: Scope for on payment
  #       - ScopeName: on-claim
  #         ScopeDescription: Scope for on claim
  #       - ScopeName: read
  #         ScopeDescription: Scope for on read
  #       - ScopeName: write
  #         ScopeDescription: Scope for on write
  #     UserPoolId: !Ref CognitoUserPool
  
Outputs:
  CognitoUserPoolName:
    Value: !Ref CognitoUserPool # resource name
    Description: Cognito user pool reference
    Export:
      Name: !Sub ${AWS::StackName}-CognitoUserPoolName
  CognitoUserPoolArn:
    Value: !GetAtt CognitoUserPool.Arn # resource name
    Description: Cognito user pool Arn
    Export:
      Name: !Sub ${AWS::StackName}-CognitoUserPoolArn