cognito.yaml

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Description: >
  This template configures a user pool domain and hosted login

Parameters:
  CognitoIdentityPoolName:
    Type: String
    Description: Cognito identity pool name.
    Default: identity pool
    MinLength: 1
    MaxLength: 128
    AllowedPattern: '^[\w ]+$'
    ConstraintDescription: Alphanumeric and spaces.

  LexBotName:
    Type: String
    Description: Lex bot name used to build IAM policy
    Default: OrderFlowers

  LexV2BotId:
    Description: >
      Name of an existing Lex V2 Bot to be used by the web ui.
    Type: String
    Default: ''

  LexV2BotAliasId:
    Description: >
      Use your Lex V2 bot's alias id.
    Type: String
    Default: ''

  ForceCognitoLogin:
    Type: String
    Default: false
    Description: >
      If set to True, the menu with a login action will not be displayed
      in the Lex Web Ui, and the Cognito login will be executed automatically.

  ShouldEnableLiveChat:
    Type: String
    Default: false
    Description: Whether or not add policy to invoke live chat API
  
  AllowedSignUpEmailDomain:
    Type: String
    Default: ''
    Description: >-
      Email address domain (example.com) or comma separated list of email domains 
      (example1.com, example2.com) allowed to signin and signup using the web UI.
      If left empty, signup via the web UI is disabled and users will have to be created using
      Cognito.
    AllowedPattern: '^(|([\w-]+\.)+[\w-]{2,6}(, *([\w-]+\.)+[\w-]{2,6})*)$'

  AllowStreamingResponses:
    Type: String
    Default: false
    AllowedValues:
    - true
    - false
    Description: >
        If set to True, a websocket API Gateway will be established and messages will be sent to this web socket
        in addition to the Lex bot directly.
  
  ShouldEnableUpload:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: >
        If set to True, the upload document functionality will be available. The icon for uploading documents
        will appear in the UI.

  UploadBucket:
    Type: String
    Default: ''
    Description: >
        If enabling upload, the name of the S3 bucket where uploaded documents should be stored

Conditions:
  ShouldAllowSignUpEmailDomain: !Not [!Equals [!Ref AllowedSignUpEmailDomain, ""]]
  NeedsForceCognitoLogin: !Equals [ !Ref ForceCognitoLogin, 'true' ]
  IsLexV1: !Not [ !Equals [!Ref LexBotName, ''] ]
  IsLexV2: !Not [ !Equals [!Ref LexV2BotId, ''] ]
  EnableLiveChat: !Equals [!Ref ShouldEnableLiveChat, true]
  EnableStreaming: !Equals [!Ref AllowStreamingResponses, true]
  EnableUpload: !Equals [!Ref ShouldEnableUpload, true]

Resources:
  CognitoIdentityPool:
    Type: AWS::Cognito::IdentityPool
    Properties:
      IdentityPoolName: !Ref CognitoIdentityPoolName
      AllowUnauthenticatedIdentities: true
      CognitoIdentityProviders:
        - ClientId: !Ref CognitoUserPoolClient
          ProviderName: !GetAtt CognitoUserPool.ProviderName

  CognitoIdentityPoolSetRole:
    Type: AWS::Cognito::IdentityPoolRoleAttachment
    Properties:
      IdentityPoolId: !Ref CognitoIdentityPool
      Roles:
        authenticated: !If [ IsLexV1, !GetAtt CognitoAuthRoleV1.Arn, !GetAtt CognitoAuthRoleV2.Arn ]
        unauthenticated: !If [ IsLexV1, !GetAtt CognitoUnauthRoleV1.Arn, !GetAtt CognitoUnauthRoleV2.Arn ]

  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: !If
          - ShouldAllowSignUpEmailDomain
          - false
          - true
      AutoVerifiedAttributes:
        - "email"
      MfaConfiguration: "OFF"
      LambdaConfig: !If
      - ShouldAllowSignUpEmailDomain
      - PreAuthentication: !GetAtt CognitoUserPoolEmailDomainVerifyFunction.Arn
        PreSignUp: !GetAtt CognitoUserPoolEmailDomainVerifyFunction.Arn
      - !Ref AWS::NoValue
      AliasAttributes:
        - "email"
      Schema:
        - AttributeDataType: String
          Name: "given_name"
          Required: true
          Mutable: true
        - AttributeDataType: String
          Name: "family_name"
          Required: true
          Mutable: true
        - AttributeDataType: String
          Name: "email"
          Required: true
          Mutable: true
        - AttributeDataType: String
          Name: "preferred_username"
          Required: true
          Mutable: true
      UserPoolName: !Join [ '-', [ 'UserPool', !Select [ 0, !Split [ "-CognitoIdentityPool", !Ref "AWS::StackName" ] ] ] ]

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      GenerateSecret: false
      UserPoolId: !Ref CognitoUserPool

  CognitoUnauthRoleV1:
    Condition: IsLexV1
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Principal:
              Federated: cognito-identity.amazonaws.com
            Effect: Allow
            Action:
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                cognito-identity.amazonaws.com:aud: !Ref CognitoIdentityPool
              ForAnyValue:StringLike:
                cognito-identity.amazonaws.com:amr: unauthenticated
      Policies:
        - PolicyName: LexPost
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: !If [ NeedsForceCognitoLogin, Deny, Allow ]
                Action:
                  - lex:PostText
                  - lex:PostContent
                  - lex:DeleteSession
                  - lex:PutSession
                Resource:
                  - !Sub "arn:aws:lex:${AWS::Region}:${AWS::AccountId}:bot:${LexBotName}:*"
        - !If 
          - EnableLiveChat
          - PolicyName: APIPost
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: !If [NeedsForceCognitoLogin, Deny, Allow]
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/Prod/POST/livechat"
          - !Ref AWS::NoValue
        - !If 
          - EnableStreaming
          - PolicyName: WebsocketConnect
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: !If [NeedsForceCognitoLogin, Deny, Allow]
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/Prod/$connect"
          - !Ref AWS::NoValue
                
  CognitoUnauthRoleV2:
    Condition: IsLexV2
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Principal:
              Federated: cognito-identity.amazonaws.com
            Effect: Allow
            Action:
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                cognito-identity.amazonaws.com:aud: !Ref CognitoIdentityPool
              ForAnyValue:StringLike:
                cognito-identity.amazonaws.com:amr: unauthenticated
      Policies:
        - PolicyName: LexV2
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: !If [ NeedsForceCognitoLogin, Deny, Allow ]
                Action:
                  - lex:RecognizeText
                  - lex:RecognizeUtterance
                  - lex:DeleteSession
                  - lex:PutSession
                Resource:
                  - !Sub "arn:aws:lex:${AWS::Region}:${AWS::AccountId}:bot-alias/${LexV2BotId}/${LexV2BotAliasId}"
        - !If 
          - EnableLiveChat
          - PolicyName: APIPost
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: !If [NeedsForceCognitoLogin, Deny, Allow]
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/Prod/POST/livechat"
          - !Ref AWS::NoValue
        - !If 
          - EnableStreaming
          - PolicyName: WebsocketConnect
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: !If [NeedsForceCognitoLogin, Deny, Allow]
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/Prod/$connect"
          - !Ref AWS::NoValue

  CognitoAuthRoleV1:
    Condition: IsLexV1
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Principal:
              Federated: cognito-identity.amazonaws.com
            Effect: Allow
            Action:
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                cognito-identity.amazonaws.com:aud: !Ref CognitoIdentityPool
              ForAnyValue:StringLike:
                cognito-identity.amazonaws.com:amr: authenticated
      Policies:
        - PolicyName: PollySynth
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - polly:SynthesizeSpeech
                Resource: '*'
        - PolicyName: LexPost
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lex:PostText
                  - lex:PostContent
                  - lex:DeleteSession
                  - lex:PutSession
                Resource:
                  - !Sub "arn:aws:lex:${AWS::Region}:${AWS::AccountId}:bot:${LexBotName}:*"
        - !If 
          - EnableLiveChat
          - PolicyName: APIPost
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/Prod/POST/livechat"
          - !Ref AWS::NoValue
        - !If 
          - EnableStreaming
          - PolicyName: WebsocketConnect
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/Prod/$connect"
          - !Ref AWS::NoValue
        - !If 
          - EnableUpload
          - PolicyName: S3Upload
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - s3:PutObject
                  Resource:
                    - !Sub "arn:aws:s3:::${UploadBucket}/*"
          - !Ref AWS::NoValue

  CognitoAuthRoleV2:
    Condition: IsLexV2
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Principal:
              Federated: cognito-identity.amazonaws.com
            Effect: Allow
            Action:
              - sts:AssumeRoleWithWebIdentity
            Condition:
              StringEquals:
                cognito-identity.amazonaws.com:aud: !Ref CognitoIdentityPool
              ForAnyValue:StringLike:
                cognito-identity.amazonaws.com:amr: authenticated
      Policies:
        - PolicyName: PollySynth
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - polly:SynthesizeSpeech
                Resource: '*'
        - PolicyName: LexV2
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - lex:RecognizeText
                  - lex:RecognizeUtterance
                  - lex:DeleteSession
                  - lex:PutSession
                Resource:
                  - !Sub "arn:aws:lex:${AWS::Region}:${AWS::AccountId}:bot-alias/${LexV2BotId}/${LexV2BotAliasId}"
        - !If 
          - EnableLiveChat
          - PolicyName: APIPostV2
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/Prod/POST/livechat"
          - !Ref AWS::NoValue
        - !If 
          - EnableStreaming
          - PolicyName: WebsocketConnect
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*/Prod/$connect"
          - !Ref AWS::NoValue
        - !If 
          - EnableUpload
          - PolicyName: S3Upload
            PolicyDocument:
              Version: 2012-10-17
              Statement:
                - Effect: Allow
                  Action:
                    - s3:PutObject
                  Resource:
                    - !Sub "arn:aws:s3:::${UploadBucket}/*"
          - !Ref AWS::NoValue

  CognitoUserPoolEmailDomainVerifyFunction:
    Type: AWS::Serverless::Function
    Condition: ShouldAllowSignUpEmailDomain
    Properties:
      Handler: index.handler
      Runtime: nodejs18.x
      Timeout: 3
      Environment:
        Variables:
          ALLOWED_SIGNUP_EMAIL_DOMAINS: !Ref AllowedSignUpEmailDomain
      InlineCode: |
        exports.handler = async (event, context) => {
          console.log(event);
          const allowed_domains = (
              process.env?.ALLOWED_SIGNUP_EMAIL_DOMAINS
              .split(",").map(domain => {return domain.trim()})
          );
          const { email } = event.request?.userAttributes;
          if (!email || !email.includes('@')) {
            throw Error('Username does not exists or invalid email address');
          }
          const emailDomain = email?.split('@')[1];
          if (!emailDomain || !allowed_domains) {
            throw new Error('Server error - invalid configuration');
          }
          if (!allowed_domains.includes(emailDomain)) {
            throw new Error('Invalid email address domain');
          }
          return event;
        };
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W89
            reason: Customer can use VPC if desired

  CognitoUserPoolEmailDomainVerifyPermission:
    Type: AWS::Lambda::Permission
    Condition: ShouldAllowSignUpEmailDomain
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref CognitoUserPoolEmailDomainVerifyFunction
      Principal: cognito-idp.amazonaws.com
      SourceAccount: !Ref AWS::AccountId
      SourceArn: !GetAtt CognitoUserPool.Arn

Outputs:
  CognitoIdentityPoolId:
    Description: Cognito identity pool id.
    Value: !Ref CognitoIdentityPool

  CognitoUserPoolId:
    Description: Cognito user pool id.
    Value: !Ref CognitoUserPool

  CognitoUserPoolClientId:
    Description: Cognito user pool client id.
    Value: !Ref CognitoUserPoolClient