serverless.yml

service: aws-cognito-multitenant

provider:
  name: aws
  region: eu-west-1
  stage: ${opt:stage, 'dev'}
  environment:
    USER_POOL_NAME: ${self:service}-UserPool-${self:provider.stage}


functions:
  autoConfirmUser:
    handler: autoConfirmUser.handler
    package:
      include:
        - autoConfirmUser.js
    events:
      - cognitoUserPool:
          pool: ${self:provider.environment.USER_POOL_NAME}
          trigger: PreSignUp
          existing: true

resources:
  Resources:
    # =================================================== User pool  =======================================================
    CognitoUserPool:
      Type: AWS::Cognito::UserPool
      Properties:
        MfaConfiguration: OFF
        UserPoolName: ${self:provider.environment.USER_POOL_NAME}
        AliasAttributes:
          - email
          - preferred_username
        AutoVerifiedAttributes:
          - email
        Schema:
          - AttributeDataType: String
            Name: tenant_id
            Mutable: true
            Required: false # Required custom attributes are not supported currently
        Policies:
          PasswordPolicy:
            MinimumLength: 6
            RequireLowercase: False
            RequireNumbers: False
            RequireSymbols: False
            RequireUppercase: False
        EmailConfiguration:
          EmailSendingAccount: COGNITO_DEFAULT

    # ============================================ User pool client  =======================================================
    CognitoUserPoolClient:
      Type: AWS::Cognito::UserPoolClient
      Properties:
        ClientName: ${self:service}-WebApp-${self:provider.stage}
        AllowedOAuthFlows:
          - implicit
        AllowedOAuthFlowsUserPoolClient: true
        AllowedOAuthScopes:
          - phone
          - email
          - openid
          - profile
          - aws.cognito.signin.user.admin
        UserPoolId:
          Ref: CognitoUserPool
        CallbackURLs:
          - https://localhost:3000
        ExplicitAuthFlows:
          - ALLOW_USER_SRP_AUTH
          - ALLOW_REFRESH_TOKEN_AUTH
        GenerateSecret: false
        SupportedIdentityProviders:
          - COGNITO
        ReadAttributes:
          - address
          - birthdate
          - custom:tenant_id
          - email
          - family_name
          - gender
          - given_name
          - locale
          - middle_name
          - name
          - nickname
          - phone_number
          - picture
          - preferred_username
          - profile
          - updated_at
          - website
          - zoneinfo
          - email_verified
          - phone_number_verified
        WriteAttributes:
          - address
          - birthdate
          - custom:tenant_id
          - email
          - family_name
          - gender
          - given_name
          - locale
          - middle_name
          - name
          - nickname
          - phone_number
          - picture
          - preferred_username
          - profile
          - updated_at
          - website
          - zoneinfo

    # ============================================= Identity pool ==========================================================
    CognitoIdentityPool:
      Type: AWS::Cognito::IdentityPool
      Properties:
        IdentityPoolName: ${self:service}_IdentityPool_${self:provider.stage}
        AllowUnauthenticatedIdentities: false
        CognitoIdentityProviders:
          - ClientId:
              Ref: CognitoUserPoolClient
            ProviderName:
              Fn::GetAtt: [ CognitoUserPool, ProviderName ]

    CognitoIdentityPoolRoles:
      Type: AWS::Cognito::IdentityPoolRoleAttachment
      Properties:
        IdentityPoolId:
          Ref: CognitoIdentityPool
        RoleMappings:
          userpool:
            IdentityProvider:
              Fn::Join:
                - ''
                - - Fn::GetAtt: [ CognitoUserPool, ProviderName ]
                  - ':'
                  - Ref: CognitoUserPoolClient
            AmbiguousRoleResolution: AuthenticatedRole
            Type: Token
        Roles:
          authenticated:
            Fn::GetAtt: [ CognitoUserRole, Arn ]

    # ================================== IAM roles used for authenticated users ============================================
    CognitoUserRole:
      Type: AWS::IAM::Role
      Properties:
        Path: /
        RoleName: ${self:service}-UserRole-${self:provider.stage}
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: 'Allow'
              Principal:
                Federated: 'cognito-identity.amazonaws.com'
              Action:
                - 'sts:AssumeRoleWithWebIdentity'
              Condition:
                StringEquals:
                  'cognito-identity.amazonaws.com:aud':
                    Ref: CognitoIdentityPool
                'ForAnyValue:StringLike':
                  'cognito-identity.amazonaws.com:amr': authenticated
  Outputs:
    UserPoolId:
      Value:
        Ref: CognitoUserPool
      Export:
        Name: UserPoolId-${self:provider.stage}
    UserPoolArn:
      Value:
        Fn::GetAtt:
          - CognitoUserPool
          - Arn
      Export:
        Name: UserPoolArn-${self:provider.stage}
    CognitoUserPoolWebClientId:
      Value:
        Ref: CognitoUserPoolClient
      Export:
        Name: CognitoUserPoolWebClientId-${self:provider.stage}
    IdentityPoolId:
      Value:
        Ref: CognitoIdentityPool