amazon-web-services - 如何将 Cognito 用户池设置导出到 CloudFormation 模板？

Question

我已通过 AWS 控制台创建了 Cognito 用户池，但我想通过 CloudFormation 自动创建新的 Cognito 用户池。我可以将当​​前的用户池配置导出到 CloudFormation 模板吗？

Answer 1

无法导出。您需要以下 6 种资源来自动化该流程。

1. 经过 Cognito 身份验证的角色
2. Cognito 未经身份验证的角色
3. 用户池
4. 用户池客户端
5. 身份池
6. 身份池角色附件

您将需要 3 个输出，您可能需要在代码中使用它们。下面是创建这些的代码

AWSTemplateFormatVersion: 2010-09-09
Parameters: 
  envParameter: 
    Type: String
    Default: dev
    AllowedValues: [ dev, test, qa, prod ]
    Description: Suffix to be added for names.
Resources:
  myApiUserPool:
    Type: "AWS::Cognito::UserPool"
    Properties:
      UserPoolName: !Sub myApiUserPool${envParameter}
  myApiUserPoolClient:
    Type: "AWS::Cognito::UserPoolClient"
    Properties:
        ClientName: !Sub myApiUserPoolClient${envParameter},
        GenerateSecret: False
        RefreshTokenValidity: 30
        UserPoolId: !Ref myApiUserPool
  myApiIdentityPool:
    Type: "AWS::Cognito::IdentityPool"
    Properties:
      IdentityPoolName: !Sub myApiIdentityPool${envParameter}
      AllowUnauthenticatedIdentities: False
      CognitoIdentityProviders:
        - ClientId: !Ref myApiUserPoolClient
          ProviderName: !GetAtt myApiUserPool.ProviderName
  cognitoUnauthRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub Cognito_${myApiIdentityPool.Name}_Unauth_Role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Federated: cognito-identity.amazonaws.com
            Action: [ 'sts:AssumeRole' ]
      Policies:
        - PolicyName: cognitounauth
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                - mobileanalytics:PutEvents
                - cognito-sync:*
                Resource:
                - "*"
  cognitoAuthRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub Cognito_${myApiIdentityPool.Name}_Auth_Role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Federated: cognito-identity.amazonaws.com
            Action: [ 'sts:AssumeRole' ]
      Policies:
        - PolicyName: cognitoauth
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                - mobileanalytics:PutEvents
                - cognito-sync:*
                - execute-api:*
                Resource:
                - "*"
  myApiIdentityPoolRoleAttachment:
    DependsOn: [ myApiIdentityPool, cognitoUnauthRole, cognitoAuthRole ]
    Type: "AWS::Cognito::IdentityPoolRoleAttachment"
    Properties:
      IdentityPoolId: !Ref myApiIdentityPool
      Roles: 
        authenticated: !GetAtt cognitoAuthRole.Arn
        unauthenticated: !GetAtt cognitoUnauthRole.Arn
Outputs:
 userPool:
    Description: "User pool ID"
    Value: !Ref myApiUserPool
 identityPool:
    Description: "Identity pool ID"
    Value: !Ref myApiIdentityPool
 ClientId: 
    Description: "Client id for the user pool appclient"
    Value: !Ref myApiUserPoolClient