AWS Cognito user pool backed by Microsoft Entra with Terraform

main.tf

locals {
  region = "eu-north-1"
}

resource "random_pet" "user_pool_name" {
  length = 2
  prefix = "test"
}

resource "aws_cognito_user_pool" "cognito" {
  name                     = random_pet.user_pool_name.id
  auto_verified_attributes = ["email"]

  deletion_protection = "ACTIVE"
  mfa_configuration   = "ON"

  admin_create_user_config {
    allow_admin_create_user_only = true
  }

  device_configuration {
    challenge_required_on_new_device      = false
    device_only_remembered_on_user_prompt = false
  }

  schema {
    attribute_data_type      = "String"
    developer_only_attribute = false
    mutable                  = true
    name                     = "email"
    required                 = true

    string_attribute_constraints {
      max_length = "2048"
      min_length = "0"
    }
  }
  schema {
    attribute_data_type      = "String"
    developer_only_attribute = false
    mutable                  = true
    name                     = "family_name"
    required                 = true

    string_attribute_constraints {
      max_length = "2048"
      min_length = "0"
    }
  }
  schema {
    attribute_data_type      = "String"
    developer_only_attribute = false
    mutable                  = true
    name                     = "given_name"
    required                 = true

    string_attribute_constraints {
      max_length = "2048"
      min_length = "0"
    }
  }

  software_token_mfa_configuration {
    enabled = true
  }

  user_attribute_update_settings {
    attributes_require_verification_before_update = ["email"]
  }

  username_configuration {
    case_sensitive = false
  }

  username_attributes = ["email"]
}

resource "aws_cognito_user_pool_domain" "cognito" {
  user_pool_id = aws_cognito_user_pool.cognito.id
  domain       = "educonvert-test-003"
}

resource "azuread_application" "cognito" {
  display_name = random_pet.user_pool_name.id

  identifier_uris = ["urn:amazon:cognito:sp:${aws_cognito_user_pool.cognito.id}"]

  web {
    redirect_uris = [
      "https://${aws_cognito_user_pool.cognito.domain}.auth.${local.region}.amazoncognito.com/saml2/idpresponse"
    ]

    implicit_grant {
      access_token_issuance_enabled = false
      id_token_issuance_enabled     = true
    }
  }

  app_role {
    id                   = "b9632174-c057-4f7e-951b-be3adc52bfe6"
    display_name         = "msiam_access"
    description          = "msiam_access"
    enabled              = true
    allowed_member_types = ["User"]
  }

  app_role {
    id                   = "18d14569-c3bd-439b-9a66-3a2aee01d14f"
    display_name         = "User"
    description          = "User"
    enabled              = true
    allowed_member_types = ["User"]
  }

  api {
    oauth2_permission_scope {
      admin_consent_description  = "Allow the application to access Test Cognito on behalf of the signed-in user."
      admin_consent_display_name = "Access Test Cognito"
      enabled                    = true
      id                         = "3e681e9b-cd28-499a-8e10-b058841ed108"
      type                       = "User"
      user_consent_description   = "Allow the application to access Test Cognito on your behalf."
      user_consent_display_name  = "Access Test Cognito"
      value                      = "user_impersonation"
    }
  }
}

resource "azuread_service_principal" "cognito" {
  application_id = azuread_application.cognito.application_id

  notification_email_addresses  = ["info@educonvert.com"]
  app_role_assignment_required  = true
  preferred_single_sign_on_mode = "saml"

  feature_tags {
    custom_single_sign_on = true
    enterprise            = true
  }

  saml_single_sign_on {

  }
}

resource "aws_cognito_identity_provider" "cognito" {
  user_pool_id  = aws_cognito_user_pool.cognito.id
  provider_name = "Microsoft365"
  provider_type = "SAML"

  provider_details = {
    "IDPSignout"            = "true"
    "MetadataURL"           = "https://login.microsoftonline.com/${azuread_service_principal.cognito.application_tenant_id}/federationmetadata/2007-06/federationmetadata.xml?appid=${azuread_service_principal.cognito.application_id}"
    "SLORedirectBindingURI" = "https://login.microsoftonline.com/${azuread_service_principal.cognito.application_tenant_id}/saml2"
    "SSORedirectBindingURI" = "https://login.microsoftonline.com/${azuread_service_principal.cognito.application_tenant_id}/saml2"
  }

  attribute_mapping = {
    "email"       = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
    "family_name" = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
    "given_name"  = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
  }
}