template.yaml

AWSTemplateFormatVersion: '2010-09-09'

Resources:
  CognitoUserPool:
    Type: "AWS::Cognito::UserPool"
    Properties:
      UserPoolName: !Join ['', [!Ref 'AWS::StackName', 'Pool']]
      AutoVerifiedAttributes:
        - email
      MfaConfiguration: "OFF"
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          RequireUppercase: false
      Schema:
        - Name: name
          AttributeDataType: String
          Mutable: true
          Required: false
        - Name: email
          AttributeDataType: String
          Mutable: false
          Required: true
        - Name: phone_number
          AttributeDataType: String
          Mutable: true
          Required: false

  CognitoUserPoolClient:
    Type: "AWS::Cognito::UserPoolClient"
    Properties:
      ClientName: 'Secured Client'
      ExplicitAuthFlows:
        - USER_PASSWORD_AUTH
      GenerateSecret: true
      ReadAttributes:
        - "address"
        - "birthdate"
        - "email"
        - "email_verified"
        - "family_name"
        - "gender"
        - "given_name"
        - "locale"
        - "middle_name"
        - "name"
        - "nickname"
        - "phone_number"
        - "phone_number_verified"
        - "picture"
        - "preferred_username"
        - "profile"
        - "updated_at"
        - "website"
        - "zoneinfo"
      RefreshTokenValidity: 30
      UserPoolId: !Ref CognitoUserPool
      WriteAttributes:
        - "address"
        - "birthdate"
        - "email"
        - "family_name"
        - "gender"
        - "given_name"
        - "locale"
        - "middle_name"
        - "name"
        - "nickname"
        - "phone_number"
        - "picture"
        - "preferred_username"
        - "profile"
        - "updated_at"
        - "website"
        - "zoneinfo"

  CognitoIdentityPool:
    Type: "AWS::Cognito::IdentityPool"
    Properties:
      IdentityPoolName: !Join ['', [!Ref 'AWS::StackName', 'IdentityPool']]
      AllowUnauthenticatedIdentities: false
      CognitoIdentityProviders:
        - ClientId: !Ref CognitoUserPoolClient
          ProviderName: !GetAtt [CognitoUserPool, ProviderName]
          ServerSideTokenCheck: true

  CognitoUnAuthorizedRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Federated: "cognito-identity.amazonaws.com"
            Action:
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud": !Ref CognitoIdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": unauthenticated
      Policies:
        - PolicyName: "CognitoUnauthorizedPolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                Resource: "*"
    # Create a role for authorized acces to AWS resources.
    # Control what your user can access. This example only allows Lambda invokation
    # Only allows users in the previously created Identity Pool
  CognitoAuthorizedRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Federated: "cognito-identity.amazonaws.com"
            Action:
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                "cognito-identity.amazonaws.com:aud": !Ref CognitoIdentityPool
              "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": authenticated
      Policies:
        - PolicyName: "CognitoAuthorizedPolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "mobileanalytics:PutEvents"
                  - "cognito-sync:*"
                  - "cognito-identity:*"
                Resource: "*"
              - Effect: "Allow"
                Action:
                  - "lambda:InvokeFunction"
                  - "execute-api:Invoke"
                Resource: "*"
  IdentityPoolRoleAttachment:
    Type: "AWS::Cognito::IdentityPoolRoleAttachment"
    Properties:
      IdentityPoolId: !Ref CognitoIdentityPool
      Roles:
        authenticated:
          Fn::GetAtt: [CognitoAuthorizedRole, Arn]
        unauthenticated:
          Fn::GetAtt: [CognitoUnAuthorizedRole, Arn]

Outputs:
  UserPoolId:
    Value: !Ref CognitoUserPool
  UserPoolClientId:
    Value: !Ref CognitoUserPoolClient
  IdentityPoolId:
    Value: !Ref CognitoIdentityPool
  Region:
    Value: !Ref 'AWS::Region'