serverlessops-api-authnz/template.yaml at main · ServerlessOpsIO/serverlessops-api-authnz · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
AWSTemplateFormatVersion: '2010-09-09'
Description: ServerlessOps API Authnz

Parameters:
  UserPoolName:
    Type: String
    Description: Name of UserPool
  UserPoolDomainName:
    Type: String
    Description: Name of UserPool Domain
  ParentDnsZoneId:
    Type: String
    Description: "Route53 Hosted Zone ID"

Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      UserPoolName: !Ref UserPoolName
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true

  # DNS
  #
  # Cognito site verification requires either an A record at the root of the site's domain or a
  # delegation to another zone. Rathert than mess with the serverlessops.io apex record we
  # create a new zone for the user pool domain and add a delegation set to the parent zone.

  AuthnzZone:
    Type: "AWS::Route53::HostedZone"
    Properties:
      Name: !Ref UserPoolDomainName
      HostedZoneConfig:
        Comment: ServerlessOps Authnz

  AuthnzDelegationSet:
    Type: "AWS::Route53::RecordSet"
    Properties:
      HostedZoneId: !Ref ParentDnsZoneId
      Name: !Ref UserPoolDomainName
      Type: NS
      TTL: '3600'
      ResourceRecords: !GetAtt AuthnzZone.NameServers

  AuthnzARecord:
    Type: "AWS::Route53::RecordSet"
    Properties:
      HostedZoneId: !Ref AuthnzZone
      Name: !Ref UserPoolDomainName
      Type: A
      AliasTarget:
        HostedZoneId: Z2FDTNDATAQYW2
        DNSName: !GetAtt UserPoolDomain.CloudFrontDistribution
        EvaluateTargetHealth: false

  SiteCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref UserPoolDomainName
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: !Ref UserPoolDomainName
          HostedZoneId: !GetAtt AuthnzZone.Id

  UserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      Domain: !Ref UserPoolDomainName
      UserPoolId: !Ref UserPool
      CustomDomainConfig:
        CertificateArn: !Ref SiteCertificate

  # SSM Parameters
  UserPoolIdSsmParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name: "/org/authnz/UserPoolId"
      Description: User Pool ID
      Type: String
      Value: !Ref UserPool