amazon-web-services - 如何在 CloudFormation 模板中引用 Cognito UserPoolDomain 别名目标？

Question

我想在 CloudFormation 模板中为 Cognito UserPoolDomain 别名目标(Cognito 自动生成的 Cloudfront 发行版)创建 A 记录。

我在 docs 中没有找到如何引用UserPoolDomain的别名目标？

我应该创建一个 Cloudfront 发行版，然后以某种方式将其传递给 Cognito？

这是我的 CloudFormation 模板的片段以及我试图实现的目标:

...
  AuthUserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      UserPoolId: !Ref AuthUserPool
      Domain: auth.example.com
      CustomDomainConfig:
        CertificateArn: !Ref CertificateArn
  AuthRecordSets:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneName: example.com.
      RecordSets:
        - Name: auth.example.com
          Type: A
          AliasTarget:
            DNSName: ???
            EvaluateTargetHealth: false
            HostedZoneId: Z2FDTNDATAQYW2 #  This is always the hosted zone ID when you create an alias record that routes traffic to a CloudFront distribution.
...

请帮忙!

Answer 1

作为解决方案，我创建了一个新的 CloudFormation 模板，该模板接受 Cognito 目标别名作为参数 (CognitoDistribution)。

创建 Cognitio UserPoolDoman 后，我运行它来查找分布

aws cognito-idp describe-user-pool-domain --domain auth.example.com \
 | jq -r '.DomainDescription.CloudFrontDistribution'

然后我使用此模板创建 DNS 记录

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  Add CNAME record for Cognito UserPoolDomain alias target (CloudFront distribution). 
  It is not part of same template as AWS::Cognito::UserPoolDomain because UserPoolDomain does not return distribution ref.
Parameters:
  HostedZoneName:
    Type: String
  UserPoolDomain:
    Type: String
  CognitoTargetAlias:
    Type: String
Resources:
  AuthRecordSets:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneName: !Sub "${HostedZoneName}."
      RecordSets:
        - Name: !Ref UserPoolDomain
          Type: A
          AliasTarget:
            DNSName: !Ref CognitoTargetAlias
            EvaluateTargetHealth: false
            #  This is always the hosted zone ID when you create an alias record that routes traffic to a CloudFront distribution.
            HostedZoneId: Z2FDTNDATAQYW2

不是干净的解决方案，但至少我不需要在控制台中执行此操作