我正在尝试通过cloudformation运行congnito，并且一切正常，但是cognito中的部分如下:
如您所见，存在“启用身份提供者”部分
而且我找不到在Cloudformation中可以将其设置为我的Cognito用户池的地方!
我尝试了此属性，但是它说不被支持。
SupportedIdentityProviders
这是我的用户池客户端代码:
UserPoolClient:
Type: "AWS::Cognito::UserPoolClient"
Properties:
ClientName: !Sub ${project}-client
ExplicitAuthFlows:
- ADMIN_NO_SRP_AUTH
- USER_PASSWORD_AUTH
GenerateSecret: false
UserPoolId: !Ref UserPool
RefreshTokenValidity: 30
这是我的用户池:
UserPool:
Type: "AWS::Cognito::UserPool"
Properties:
UserPoolName: !Sub ${project}-user-pool-test
AutoVerifiedAttributes:
- email
UsernameAttributes:
- email
MfaConfiguration: "OFF"
LambdaConfig:
CustomMessage:
Fn::ImportValue: !Sub ${project}-${EnvironmentApp}-lambda-cognito-custom-message-post
Policies:
PasswordPolicy:
MinimumLength: !Ref MinimumLength
RequireLowercase: !Ref RequireLowercase
RequireNumbers: !Ref RequireNumbers
RequireSymbols: !Ref RequireSymbols
RequireUppercase: !Ref RequireUppercase
Schema:
-
AttributeDataType: String
DeveloperOnlyAttribute: false
Mutable: true
Name: !Sub ${project}-stg
Required: false
-
AttributeDataType: String
DeveloperOnlyAttribute: false
Mutable: true
Name: !Sub zuora-stg
Required: false
-
AttributeDataType: String
DeveloperOnlyAttribute: false
Mutable: true
Name: !Sub salesforce-stg
Required: false
云形成支持吗？我感谢您的帮助吗？
最佳答案
正如其他答案所暗示的那样，到目前为止，这还不能在CloudFormation中本地完成。但是，正如ASR答案所建议的，可以通过CloudFormation自定义资源来实现。
我的雇主已开放其自定义资源集合，包括CognitoUserPool和CognitoDomainName
(CloudFormation中也不支持)。定制资源源代码
can be found on github
以下是有关设置的手册说明-您始终可以通过在CloudFormation中放置自定义资源支持Lambda来进一步自动进行操作。
以下所有命令均适用于Mac。您可能需要修改其他的base64标志
平台
1.为Lambda创建IAM角色
aws iam create-role --role-name LambdaRoleCognito --assume-role-policy-document '{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}'
aws iam attach-role-policy --role-name LambdaRoleCognito \
--policy-arn arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
aws iam attach-role-policy --role-name LambdaRoleCognito \
--policy-arn arn:aws:iam::aws:policy/AmazonCognitoPowerUser
2.下载lambda源代码，上传到本地存储桶，然后创建lambda
wget https://github.com/base2Services/cloudformation-custom-resources-nodejs/releases/download/1.0.0/ccr-nodejs-1.0.0.zip
account_id=$(aws sts get-caller-identity --query Account --output text)
aws s3 mb s3://${account_id}.cfncustomres.source
aws s3 cp ccr-nodejs-1.0.0.zip s3://${account_id}.cfncustomres.source/ccr-nodejs-1.0.0.zip
aws lambda create-function --function-name CfnCrCognitUPC --runtime nodejs6.10 \
--role arn:aws:iam::${account_id}:role/LambdaRoleCognito \
--timeout 30 \
--memory-size 512 \
--code S3Bucket=${account_id}.cfncustomres.source,S3Key=ccr-nodejs-1.0.0.zip \
--handler cognito-user-pool-client/index.handler
3. 可选，通过调用测试有效负载来测试lambda
aws lambda invoke --function-name CfnCrCognitUPC --payload '{
"StackId": "arn:aws:cloudformation:us-west-2:EXAMPLE/stack-name/guid",
"ResponseURL": "http://pre-signed-S3-url-for-response",
"ResourceProperties": {
"ClientName": "MyCCRCreatedUP",
"SupportedIdentityProviders": [
"COGNITO"
],
"UserPoolId":"!! REPLACE WITH YOUR USER POOL ID !!"
},
"RequestType": "Create",
"ResourceType": "Custom::TestResource",
"RequestId": "unique id for this create request",
"LogicalResourceId": "MyTestResource"
}' --log-type Tail --invocation-type RequestResponse output.txt --query LogResult --output text | base64 -D
4.在CloudFormation模板中创建自定义资源
有关所有支持的属性的列表，请 checkout custom resource JSON schema
Resources:
MyPoolApplication:
Type: Custom::CognitoUserPool
Properties:
ServiceToken: arn:aws:lambda:<<REPLACE_WITH_YOUR_REGION>>:<<REPLACE_WITH_YOUR_ACCOUNT_ID>>:function:CfnCrCognitUPC
ClientName: ApplicationClientNameHere
UserPoolId:
Ref: UserPool
SupportedIdentityProviders:
- COGNITO
.... other support properties ....
关于amazon-web-services - 无法通过CloudFormation设置Cognito用户池客户端的属性，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/51410345/