BFF pulumi cognito

index.js

////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// Cognito
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

const userPool = new aws.cognito.UserPool("userPool", {
    autoVerifiedAttributes: ["email"],
});

const userPoolClient = new aws.cognito.UserPoolClient("userPoolClient", {
    allowedOauthFlows: ["code"],
    allowedOauthFlowsUserPoolClient: true,
    allowedOauthScopes: ["phone", "email", "openid", "profile", "aws.cognito.signin.user.admin"],
    callbackUrls: ["http://localhost:3000", "https://myapp.com"],
    defaultRedirectUri: "https://myapp.com",
    generateSecret: false,
    logoutUrls: ["http://localhost:3000", "https://myapp.com"],
    supportedIdentityProviders: ["COGNITO", "Google"], // , "Facebook"
    userPoolId: userPool.id,
});

const userPoolDomain = new aws.cognito.UserPoolDomain("userPoolDomain", {
    domain: "mybff",
    userPoolId: userPool.id,
});
const identityProviderGoogle = new aws.cognito.IdentityProvider("identityProviderGoogle", {
    attributeMapping: {
        email: "email",
        username: "sub",
    },
    providerDetails: {
        authorize_scopes: "openid email profile",
        client_id: "xxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com",
        client_secret: "xxxxxxxxxxxxxxxxxxxxxxxx",
    },
    providerName: "Google",
    providerType: "Google",
    userPoolId: userPool.id,
});

const identityPool = new aws.cognito.IdentityPool("identityPool", {
    allowUnauthenticatedIdentities: true,
    cognitoIdentityProviders: [{
        client_id: userPoolClient.id,
        providerName: userPool.endpoint,
        serverSideTokenCheck: true,
    }],
    identityPoolName: "identityPool",
});

const identityPoolAuthenticatedRole = new aws.iam.Role("identityPoolAuthenticatedRole", {
    assumeRolePolicy: identityPool.id.apply(id => JSON.stringify({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Federated": "cognito-identity.amazonaws.com"
                },
                "Action": "sts:AssumeRoleWithWebIdentity",
                "Condition": {
                    "StringEquals": {
                        "cognito-identity.amazonaws.com:aud": id
                    },
                    "ForAnyValue:StringLike": {
                        "cognito-identity.amazonaws.com:amr": "authenticated"
                    }
                }
            }
        ]
    })),
});

const identityPoolAuthenticatedRolePolicy = new aws.iam.RolePolicy("identityPoolAuthenticatedRolePolicy", {
    policy: JSON.stringify({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "mobileanalytics:PutEvents",
                    "cognito-sync:*",
                    "cognito-identity:*"
                ],
                "Resource": [
                    "*"
                ]
            }
        ]
    }),
    role: identityPoolAuthenticatedRole.id,
});

const identityPoolUnauthenticatedRole = new aws.iam.Role("identityPoolUnauthenticatedRole", {
    assumeRolePolicy: identityPool.id.apply(id => JSON.stringify({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Federated": "cognito-identity.amazonaws.com"
                },
                "Action": "sts:AssumeRoleWithWebIdentity",
                "Condition": {
                    "StringEquals": {
                        "cognito-identity.amazonaws.com:aud": id
                    },
                    "ForAnyValue:StringLike": {
                        "cognito-identity.amazonaws.com:amr": "unauthenticated"
                    }
                }
            }
        ]
    })),
});

const identityPoolUnauthenticatedRolePolicy = new aws.iam.RolePolicy("identityPoolUnauthenticatedRolePolicy", {
    policy: JSON.stringify({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "mobileanalytics:PutEvents",
                    "cognito-sync:*",
                ],
                "Resource": [
                    "*"
                ]
            }
        ]
    }),
    role: identityPoolUnauthenticatedRole.id,
});

const identityPoolRoleAttachment = new aws.cognito.IdentityPoolRoleAttachment("identityPoolRoleAttachment", {
    identityPoolId: identityPool.id,
    roles: {
        authenticated: identityPoolAuthenticatedRole.arn,
        unauthenticated: identityPoolUnauthenticatedRole.arn,
    },
});

exports.userPoolId = userPool.id;
exports.userPoolName = userPool.name;
exports.userPoolClientId = userPoolClient.id;
exports.identityPoolId = identityPool.id;