amazon-web-services - 无法创建 AWS Cognito 身份池

Question

我正在尝试创建一个堆栈，该堆栈将使用其应用程序客户端和身份池创建用户池。这是堆栈:

{
    "AWSTemplateFormatVersion": "2010-09-09",
 
    "Parameters" : {
        "CognitoUserPoolName": {
            "Description": "Name of the Cognito user pool as a parameter passed into this template.",
            "Type": "String"
        }
    },

    "Resources": {
        "UserPool": {
            "Type": "AWS::Cognito::UserPool",
            "Properties": {
                "UserPoolName" : {
                    "Ref": "CognitoUserPoolName"
                },
                "Policies": {
                    "PasswordPolicy": {
                        "MinimumLength": 8,
                        "RequireUppercase": true,
                        "RequireLowercase": true,
                        "RequireNumbers": true,
                        "RequireSymbols": true
                    }
                },
                "Schema": [
                    {
                        "Name": "name",
                        "AttributeDataType": "String",
                        "Mutable": true,
                        "Required": false
                    },
                    {
                        "Name": "email",
                        "AttributeDataType": "String",
                        "Mutable": false,
                        "Required": true
                    },
                    {
                        "Name": "phone_number",
                        "AttributeDataType": "String",
                        "Mutable": false,
                        "Required": false
                    }
                ],
                "LambdaConfig": {},
                "AutoVerifiedAttributes": [
                    "email"
                ],
                "UsernameAttributes": [
                    "email"
                ],
                "SmsVerificationMessage": "Your verification code is {####}. ",
                "EmailVerificationMessage": "Your app verification code is {####}. ",
                "EmailVerificationSubject": "Your app verification code",
                "SmsAuthenticationMessage": "Your authentication code is {####}. ",
                "MfaConfiguration": "OFF",
                "EmailConfiguration": {},
                "UserPoolTags": {},
                "AdminCreateUserConfig": {
                    "AllowAdminCreateUserOnly": false,
                    "UnusedAccountValidityDays": 7,
                    "InviteMessageTemplate": {
                        "SMSMessage": "Your username is {username} and temporary password is {####}. ",
                        "EmailMessage": "Your username is {username} and temporary password is {####}. ",
                        "EmailSubject": "Your temporary password"
                    }
                }         
            }
        },
        "UserPoolClient": {
            "Type": "AWS::Cognito::UserPoolClient",
            "Description": "App Client.",
            "DependsOn": "UserPool",
            "Properties": {
                "ClientName": {
                    "Fn::Sub": "${CognitoUserPoolName}Client"
                },
                "ExplicitAuthFlows": [
                    "ADMIN_NO_SRP_AUTH"
                ],
                "GenerateSecret": false,
                "RefreshTokenValidity": 30,
                "UserPoolId": {
                    "Ref": "UserPool"
                }
            }
        },
        "IdentityPool": {
            "Type" : "AWS::Cognito::IdentityPool",
            "DependsOn": ["UserPool", "UserPoolClient"],
            "Properties" : {
                "AllowUnauthenticatedIdentities" : false,
                "CognitoIdentityProviders" : [
                    {
                        "ClientId": {
                            "Ref": "UserPool"
                        },
                        "ProviderName": {
                            "Fn::GetAtt": [
                                "UserPool",
                                "Arn"
                            ]
                        }
                    }
                ],
                "IdentityPoolName" : {
                    "Fn::Sub": "${CognitoUserPoolName}IdentityPool"
                }
            }
        }
    },
    "Outputs": {
        "UserPoolARN": {
            "Value": {
                "Fn::GetAtt": [
                    "UserPool",
                    "Arn"
                ]
            }
        }
    }
}

我不断收到此错误:

dentityPool CREATE_FAILED   1 validation error detected: Value 'us-east-1_<>' at 'cognitoIdentityProviders.1.member.clientId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\w_]+ (Service: AmazonCognitoIdentity; Status Code: 400; Error Code: ValidationException; Request ID: <>)

用户池 ID 的格式似乎不正确。

我尝试像这样编辑 CognitoIdentityProviders:

"CognitoIdentityProviders" : [
                    {
                        "ClientId": {
                            "Ref": "UserPool"
                        }
                    },
                    {
                        "ClientId": {
                            "Ref": "UserPoolClient"
                        }
                    }
                ],

但我不断收到同样的错误。我之前使用控制台创建过身份池，您应该添加用户池 ID 和应用程序客户端 ID，以及用户池 ID 的格式为 us-east-1-1_string。

Update 18 Jun

按照下面 jens 的回答，我能够创建身份池。但是，用户池 ID 和应用客户端 id 都具有用户池 ID 的值:us-east-1 -1_string。

我尝试添加另一个提供商，如下所示:

"ClientId": {
    "Ref": "UserPoolClient"
},
"ProviderName": {
    "Fn::GetAtt": [
        "UserPool",
        "ProviderName"
    ]
}

它确实创建了正确的提供者:

• 用户池 ID:us-east-1-1_string。例如:us-east-1_Ab129faBb

• 应用客户端 ID:字符串。例如:7lhlkkfbfb4q5kpp90urffao

  但是提供者有重复。我已经尝试过

• 将应用程序客户端 ID、提供程序名称更改为 UserPoolClient，但创建失败。

• 删除应用客户端 ID 的 ProviderName，但创建失败。

Answer 1

这似乎是 CloudFormation 实现中的一个错误。

如果将 ClientID 从 us-east-1-1_string 更改为 us_east_1_1_string，则会构建模板，并且 UI 会显示正确的原始字符串(带有破折号)。

由于 CloudFormation 也没有替换功能，因此替换字符串的唯一方法是拆分并重新连接字符串部分。

因此，对于 3 个破折号，您需要以下构造:

"ClientId": {
  "Fn::Join": ["_",
    [{"Fn::Select": ["0",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
    {"Fn::Select": ["1",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
    {"Fn::Select": ["2",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
    {"Fn::Select": ["3",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]}
    ] 
  ]
}

我尝试执行你的模板，它总是为我生成一个带有 2 个破折号的字符串。因此，对于两个破折号版本，这将是完整的模板:

{
    "AWSTemplateFormatVersion": "2010-09-09",

    "Parameters": {
        "CognitoUserPoolName": {
            "Description": "Name of the Cognito user pool as a parameter passed into this template.",
            "Type": "String"
        }
    },

    "Resources": {
        "UserPool": {
            "Type": "AWS::Cognito::UserPool",
            "Properties": {
                "UserPoolName": {
                    "Ref": "CognitoUserPoolName"
                },
                "Policies": {
                    "PasswordPolicy": {
                        "MinimumLength": 8,
                        "RequireUppercase": true,
                        "RequireLowercase": true,
                        "RequireNumbers": true,
                        "RequireSymbols": true
                    }
                },
                "Schema": [{
                        "Name": "name",
                        "AttributeDataType": "String",
                        "Mutable": true,
                        "Required": false
                    },
                    {
                        "Name": "email",
                        "AttributeDataType": "String",
                        "Mutable": false,
                        "Required": true
                    },
                    {
                        "Name": "phone_number",
                        "AttributeDataType": "String",
                        "Mutable": false,
                        "Required": false
                    }
                ],
                "LambdaConfig": {},
                "AutoVerifiedAttributes": [
                    "email"
                ],
                "UsernameAttributes": [
                    "email"
                ],
                "SmsVerificationMessage": "Your verification code is {####}. ",
                "EmailVerificationMessage": "Your app verification code is {####}. ",
                "EmailVerificationSubject": "Your app verification code",
                "SmsAuthenticationMessage": "Your authentication code is {####}. ",
                "MfaConfiguration": "OFF",
                "EmailConfiguration": {},
                "UserPoolTags": {},
                "AdminCreateUserConfig": {
                    "AllowAdminCreateUserOnly": false,
                    "UnusedAccountValidityDays": 7,
                    "InviteMessageTemplate": {
                        "SMSMessage": "Your username is {username} and temporary password is {####}. ",
                        "EmailMessage": "Your username is {username} and temporary password is {####}. ",
                        "EmailSubject": "Your temporary password"
                    }
                }
            }
        },
        "UserPoolClient": {
            "Type": "AWS::Cognito::UserPoolClient",
            "Description": "App Client.",
            "DependsOn": "UserPool",
            "Properties": {
                "ClientName": {
                    "Fn::Sub": "${CognitoUserPoolName}Client"
                },
                "ExplicitAuthFlows": [
                    "ADMIN_NO_SRP_AUTH"
                ],
                "GenerateSecret": false,
                "RefreshTokenValidity": 30,
                "UserPoolId": {
                    "Ref": "UserPool"
                }
            }
        },
        "IdentityPool": {
            "Type": "AWS::Cognito::IdentityPool",
            "DependsOn": ["UserPool", "UserPoolClient"],
            "Properties": {
                "AllowUnauthenticatedIdentities": false,
                "CognitoIdentityProviders": [{
                    "ClientId": {
                      "Fn::Join": [
                        "_",
                        [
                            {
                                "Fn::Select": [
                                    "0",
                                    {
                                        "Fn::Split": [
                                            "-",
                                            {
                                                "Ref": "UserPool"
                                            }
                                        ]
                                    }
                                ]
                            },
                            {
                                "Fn::Select": [
                                    "1",
                                    {
                                        "Fn::Split": [
                                            "-",
                                            {
                                                "Ref": "UserPool"
                                            }
                                        ]
                                    }
                                ]
                            },
                            {
                                "Fn::Select": [
                                    "2",
                                    {
                                        "Fn::Split": [
                                            "-",
                                            {
                                                "Ref": "UserPool"
                                            }
                                        ]
                                    }
                                ]
                            }
                        ]
                    ]
                    },
                    "ProviderName": {
                        "Fn::GetAtt": [
                            "UserPool",
                            "ProviderName"
                        ]
                    }
                }],
                "IdentityPoolName": {
                    "Fn::Sub": "${CognitoUserPoolName}IdentityPool"
                }
            }
        }
    },
    "Outputs": {
        "UserPoolARN": {
            "Value": {
                "Fn::GetAtt": [
                    "UserPool",
                    "Arn"
                ]
            }
        }
    }
}