From 68135d9c8440dab71b8b3d8914681700a8da9a1c Mon Sep 17 00:00:00 2001 From: Brian Ojeda <9335829+sgtoj@users.noreply.github.com> Date: Sat, 5 Aug 2023 18:58:53 +0000 Subject: [PATCH] initial commit --- .devcontainer/Dockerfile | 25 +++ .devcontainer/devcontainer.json | 48 +++++ .editorconfig | 26 +++ .github/.dependabot.yml | 6 + .github/workflows/release.yml | 29 +++ .github/workflows/semantic-check.yml | 26 +++ .gitignore | 61 ++++++ CONTRIBUTING.md | 85 ++++++++ LICENSE | 21 ++ README.md | 63 ++++++ context.tf | 277 +++++++++++++++++++++++++++ examples/complete/main.tf | 28 +++ examples/complete/output.tf | 29 +++ examples/complete/provider.tf | 3 + examples/complete/version.tf | 7 + main.tf | 163 ++++++++++++++++ outputs.tf | 29 +++ variables.tf | 238 +++++++++++++++++++++++ version.tf | 10 + 19 files changed, 1174 insertions(+) create mode 100755 .devcontainer/Dockerfile create mode 100755 .devcontainer/devcontainer.json create mode 100755 .editorconfig create mode 100644 .github/.dependabot.yml create mode 100644 .github/workflows/release.yml create mode 100644 .github/workflows/semantic-check.yml create mode 100644 .gitignore create mode 100644 CONTRIBUTING.md create mode 100644 LICENSE create mode 100755 README.md create mode 100755 context.tf create mode 100755 examples/complete/main.tf create mode 100644 examples/complete/output.tf create mode 100755 examples/complete/provider.tf create mode 100644 examples/complete/version.tf create mode 100755 main.tf create mode 100755 outputs.tf create mode 100755 variables.tf create mode 100755 version.tf diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile new file mode 100755 index 0000000..199f278 --- /dev/null +++ b/.devcontainer/Dockerfile @@ -0,0 +1,25 @@ +FROM mcr.microsoft.com/vscode/devcontainers/base:jammy + +# install aws +RUN SYSTEM_ARCH=$(uname -m) \ + && curl "https://awscli.amazonaws.com/awscli-exe-linux-${SYSTEM_ARCH}.zip" -o "awscliv2.zip" \ + && unzip awscliv2.zip \ + && aws/install \ + && aws --version \ + && rm -rf aws + +# install terraform +ENV TERRAFORM_VERSION=1.5.1 +ENV TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin-cache +RUN mkdir -p $TF_PLUGIN_CACHE_DIR +RUN SYSTEM_ARCH=$(dpkg --print-architecture) \ + && curl -OL https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_${SYSTEM_ARCH}.zip \ + && unzip terraform_${TERRAFORM_VERSION}_linux_${SYSTEM_ARCH}.zip \ + && mv terraform /usr/local/bin/ \ + && terraform version \ + && rm terraform_${TERRAFORM_VERSION}_linux_${SYSTEM_ARCH}.zip + +# verify installs +RUN terraform --version \ + && aws --version \ + && docker --version diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100755 index 0000000..0043417 --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,48 @@ +{ + "name": "Terraform", + "dockerFile": "Dockerfile", + "features": { + "ghcr.io/devcontainers/features/docker-in-docker:2.2.1": {} + }, + "mounts": [ + "source=${localEnv:HOME}/.aws,target=/home/vscode/.aws,type=bind,consistency=cached" + ], + "containerEnv": { + "TF_PLUGIN_CACHE_DIR": "${containerWorkspaceFolder}/.devcontainer/tmp/.terraform.d/" + }, + "customizations": { + "vscode": { + "settings": { + "editor.codeActionsOnSave": { + "source.fixAll": true + }, + "editor.formatOnSave": true, + "editor.formatOnType": false, + "editor.inlineSuggest.enabled": true, + "terminal.integrated.shell.linux": "/bin/bash", + "python.defaultInterpreterPath": "/usr/bin/python3", + "[markdown]": { + "editor.rulers": [ + 80 + ] + }, + "[python]": { + "editor.defaultFormatter": "ms-python.black-formatter" + } + }, + "extensions": [ + "darkriszty.markdown-table-prettify", + "dbaeumer.vscode-eslint", + "editorconfig.editorconfig", + "github.copilot", + "github.copilot-chat", + "github.vscode-github-actions", + "hashicorp.terraform", + "ms-azuretools.vscode-docker", + "ms-python.black-formatter", + "tsandall.opa", + "VisualStudioExptTeam.vscodeintellicode" + ] + } + } +} \ No newline at end of file diff --git a/.editorconfig b/.editorconfig new file mode 100755 index 0000000..0cd22c7 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,26 @@ +[*] +indent_style = space +indent_size = 2 +end_of_line = lf +insert_final_newline = true +trim_trailing_whitespace = true +charset = utf-8 + +[{Dockerfile,Dockerfile.*}] +indent_size = 4 +tab_width = 4 + +[{Makefile,makefile,GNUmakefile}] +indent_style = tab +indent_size = 4 + +[Makefile.*] +indent_style = tab +indent_size = 4 + +[**/*.{go,mod,sum}] +indent_style = tab +indent_size = unset + +[**/*.py] +indent_size = 4 diff --git a/.github/.dependabot.yml b/.github/.dependabot.yml new file mode 100644 index 0000000..1230149 --- /dev/null +++ b/.github/.dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..1f3031f --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,29 @@ +name: release + +on: + push: + branches: + - main + +permissions: + contents: write + +jobs: + release: + runs-on: ubuntu-latest + steps: + - name: Checkout Code + uses: actions/checkout@v3 + - name: Bump Version + id: tag_version + uses: mathieudutour/github-tag-action@v6.1 + with: + github_token: ${{ secrets.GITHUB_TOKEN }} + default_bump: minor + custom_release_rules: bug:patch:Fixes,chore:patch:Chores,docs:patch:Documentation,feat:minor:Features,refactor:minor:Refactors,test:patch:Tests,ci:patch:Development,dev:patch:Development + - name: Create Release + uses: ncipollo/release-action@v1.12.0 + with: + tag: ${{ steps.tag_version.outputs.new_tag }} + name: ${{ steps.tag_version.outputs.new_tag }} + body: ${{ steps.tag_version.outputs.changelog }} diff --git a/.github/workflows/semantic-check.yml b/.github/workflows/semantic-check.yml new file mode 100644 index 0000000..2e5d44f --- /dev/null +++ b/.github/workflows/semantic-check.yml @@ -0,0 +1,26 @@ +name: semantic-check +on: + pull_request_target: + types: + - opened + - edited + - synchronize + +permissions: + contents: read + pull-requests: read + +jobs: + main: + name: Semantic Commit Message Check + runs-on: ubuntu-latest + steps: + - name: Checkout Code + uses: actions/checkout@v3 + - uses: amannn/action-semantic-pull-request@v5.2.0 + name: Check PR for Semantic Commit Message + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + requireScope: false + validateSingleCommit: true diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..59b7e01 --- /dev/null +++ b/.gitignore @@ -0,0 +1,61 @@ +# .gitignore + +# terraform files +.terraform.lock.hcl +.terraform.tfstate.lock.info +*.tfstate +*.tfstate.*.backup +*.tfstate.backup +*.tfplan +*.terraform/ +*.tfvars +.grunt + +# node.js / typescript +node_modules +npm-debug.log +yarn-error.log +dist +out +*.tsbuildinfo + +# logs +logs +*.log +npm-debug.log* +yarn-debug.log* +yarn-error.log* + +# runtime data +pids +*.pid +*.seed +*.pid.lock + +# coverage directories +coverage +lib-cov + +# docker files +*.tar +dockerfile.*.bak + +# general +tmp/ +!**/.gitkeep +.DS_Store +.env +.env.local +.env.development.local +.env.test.local +.env.production.local + +# ides +.vscode +.idea +*.swp +*.swo + +# opa +bundle.tar.gz + diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..797608e --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,85 @@ +# Contributing + +We welcome contributions to the project. This document provides information and +guidelines for contributing. + +## Development Environment + +This repository includes a configuration for a development container using the +[VS Code Remote - Containers extension](https://code.visualstudio.com/docs/remote/containers). +This setup allows you to develop within a Docker container that already has all +the necessary tools and dependencies installed. + +The development container is based on Ubuntu 20.04 (Focal) and includes the +following tools: + +- AWS CLI +- Python v3.8 +- Python Packages: `boto3`, `black` +- Docker CLI +- Terraform + +### Prerequisites + +- [Docker](https://www.docker.com/products/docker-desktop) installed on your + local machine. +- [Visual Studio Code](https://code.visualstudio.com/) installed on your + local machine. +- [Remote - Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers) + for Visual Studio Code. + +### Usage + +1. Clone and open this repository: + + ```bash + git clone https://github.com/cruxstack/terraform-aws-cognito-userpool.git + code terraform-aws-cognito-userpool + ``` + +2. When prompted to "Reopen in Container", click "Reopen in Container". This + will start building the Docker image for the development container. If you're + not prompted, you can open the Command Palette (F1 or Ctrl+Shift+P), and run + the "Remote-Containers: Reopen Folder in Container" command. + +3. After the development container is built and started, you can use the + Terminal in Visual Studio Code to interact with the container. All commands + you run in the Terminal will be executed inside the container. + +### Troubleshooting + +If you encounter any issues while using the development container, you can try +rebuilding the container. To do this, open the Command Palette and run the +"Remote-Containers: Rebuild Container" command. + +## Contribution Guidelines + +We appreciate your interest in contributing to the project. Here are some +guidelines to help ensure your contributions are accepted. + +### Issues + +- Use the GitHub issue tracker to report bugs or propose new features. +- Before submitting a new issue, please search to make sure it has not already + been reported. If it has, add a comment to the existing issue instead of + creating a new one. +- When reporting a bug, include as much detail as you can. Include the version + of the module you're using, what you expected to happen, what actually + happened, and steps to reproduce the bug. + +### Pull Requests + +- Submit your changes as a pull request. +- All pull requests should be associated with an issue. If your change isn't + associated with an existing issue, please create one before submitting a pull + request. +- In your pull request, include a summary of the changes, the issue number it + resolves, and any additional information that might be helpful for + understanding your changes. +- Make sure your changes do not break any existing functionality. If your + changes require updates to existing tests or the addition of new ones, include + those in your pull request. +- Follow the existing code style. We use a linter to maintain code quality, so + make sure your changes pass the linter checks. + +Thank you for your contributions! diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..f578144 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 Brian Ojeda + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md new file mode 100755 index 0000000..3458595 --- /dev/null +++ b/README.md @@ -0,0 +1,63 @@ +# Terraform Module: AWS Cognito Userpool + +Terraform module to create AWS Cognito Userpools. This module is designed to +have sensiable defaults for a userpool and be easily extensible for more +advanced use cases. + +## Usage + +```hcl +module "cognito_userpool" { + source = "cruxstack/cognito-userpool/aws" + version = "x.x.x" +} +``` + +## Inputs + +This module uses the `cloudposse/label/null` module for naming and tagging +resources. As such, it also includes a `context.tf` file with additional +optional variables you can set. Refer to the [`cloudposse/label` documentation](https://registry.terraform.io/modules/cloudposse/label/null/latest) +for more details on these variables. + +| Name | Description | Type | Default | Required | +|--------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------:|:---------------------:|:--------:| +| email_config | Configuration email from the userpool. | object | {} | No | +| email_verification_message | A string representing the email verification message | string | "" | No | +| email_verification_subject | A string representing the email verification subject | string | "" | No | +| admin_create_user_config | The configuration for AdminCreateUser requests | object | {} | No | +| alias_attributes | Attributes supported as an alias for this userpool. Possible values: phone_number, email, or preferred_username. Conflicts with `username_attributes`. | list(string) | [] | No | +| username_attributes | Specifies whether email addresses or phone numbers can be specified as usernames when a user signs up. Conflicts with `alias_attributes`. | list(string) | null | No | +| deletion_protection | When `true`, it prevents accidental deletion of your userpool. Before you can delete a userpool that you have protected against deletion, you must set this to `false`. | bool | true | No | +| auto_verified_attributes | The attributes to be auto-verified. Possible values: `email`, `phone_number`. | list(string) | [] | No | +| device_config | The configuration for the userpool's device tracking. | object | {} | No | +| lambda_config | Configuration any AWS Lambda triggers associated with the userpool. | object | {} | No | +| mfa_config | Set to enable multi-factor authentication. Must be one of the following values: `ON`, `OFF`, or `OPTIONAL`. | string | "OFF" | No | +| password_policy | A container for information about the userpool password policy. | object | {} | No | +| recovery_mechanisms | List of account recovery options. | list(string) | [] | No | +| sms_config | Configuration for SMS | object | {} | No | +| sms_authentication_message | A string representing the SMS authentication message. | string | "Your code is {####}" | No | +| sms_verification_message | A string representing the SMS verification message. | string | "Your code is {####}" | No | +| software_token_mfa_config | Configuration for software token multi-factor authentication. | object | {} | No | +| user_attribute_schemas | Map of all user attribute schemas. The key is the attribute name. | map(object) | {} | No | +| user_attribute_update_settings | Configuration block for user attribute update settings. | object | {} | No | +| username_config | Configuration for sername. Setting `case_sensitive` specifies whether username case sensitivity will be applied for all users in the userpool through Cognito APIs. | object | {} | No | +| userpool_add_ons | Configuration block for userpool add-ons to enable userpool advanced security mode features | object | {} | No | +| verification_message_template | Configuration for verification message templates. | object | {} | No | + +## Outputs + +| Name | Description | +|--------------------|--------------------------------------| +| id | ID of the userpool. | +| arn | ARN of the userpool. | +| name | Name of the userpool. | +| endpoint | Dndpoint name of the userpool. | +| creation_date | Date the userpool was created. | +| last_modified_date | Date the userpool was last modified. | + +## Contributing + +We welcome contributions to this project. For information on setting up a +development environment and how to make a contribution, see [CONTRIBUTING](./CONTRIBUTING.md) +documentation. diff --git a/context.tf b/context.tf new file mode 100755 index 0000000..873244c --- /dev/null +++ b/context.tf @@ -0,0 +1,277 @@ +# +# ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label +# All other instances of this file should be a copy of that one +# +# +# Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf +# and then place it in your Terraform module to automatically get +# Cloud Posse's standard configuration inputs suitable for passing +# to Cloud Posse modules. +# +# curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf +# +# Modules should access the whole context as `module.this.context` +# to get the input variables with nulls for defaults, +# for example `context = module.this.context`, +# and access individual variables as `module.this.`, +# with final values filled in. +# +# For example, when using defaults, `module.this.context.delimiter` +# will be null, and `module.this.delimiter` will be `-` (hyphen). +# + +module "this" { + source = "cloudposse/label/null" + version = "0.25.0" # requires Terraform >= 0.13.0 + + enabled = var.enabled + namespace = var.namespace + tenant = var.tenant + environment = var.environment + stage = var.stage + name = var.name + delimiter = var.delimiter + attributes = var.attributes + tags = var.tags + additional_tag_map = var.additional_tag_map + label_order = var.label_order + regex_replace_chars = var.regex_replace_chars + id_length_limit = var.id_length_limit + label_key_case = var.label_key_case + label_value_case = var.label_value_case + descriptor_formats = var.descriptor_formats + labels_as_tags = var.labels_as_tags + + context = var.context +} + +# Copy contents of cloudposse/terraform-null-label/variables.tf here + +variable "context" { + type = any + default = { + enabled = true + namespace = null + tenant = null + environment = null + stage = null + name = null + delimiter = null + attributes = [] + tags = {} + additional_tag_map = {} + regex_replace_chars = null + label_order = [] + id_length_limit = null + label_key_case = null + label_value_case = null + descriptor_formats = {} + # Note: we have to use [] instead of null for unset lists due to + # https://github.com/hashicorp/terraform/issues/28137 + # which was not fixed until Terraform 1.0.0, + # but we want the default to be all the labels in `label_order` + # and we want users to be able to prevent all tag generation + # by setting `labels_as_tags` to `[]`, so we need + # a different sentinel to indicate "default" + labels_as_tags = ["unset"] + } + description = <<-EOT + Single object for setting entire context at once. + See description of individual variables for details. + Leave string and numeric variables as `null` to use default value. + Individual variable settings (non-null) override settings in context object, + except for attributes, tags, and additional_tag_map, which are merged. + EOT + + validation { + condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) + error_message = "Allowed values: `lower`, `title`, `upper`." + } + + validation { + condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) + error_message = "Allowed values: `lower`, `title`, `upper`, `none`." + } +} + +variable "enabled" { + type = bool + default = null + description = "Set to false to prevent the module from creating any resources" +} + +variable "namespace" { + type = string + default = null + description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" +} + +variable "tenant" { + type = string + default = null + description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" +} + +variable "environment" { + type = string + default = null + description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" +} + +variable "stage" { + type = string + default = null + description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" +} + +variable "name" { + type = string + default = null + description = <<-EOT + ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. + This is the only ID element not also included as a `tag`. + The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. + EOT +} + +variable "delimiter" { + type = string + default = null + description = <<-EOT + Delimiter to be used between ID elements. + Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. + EOT +} + +variable "attributes" { + type = list(string) + default = [] + description = <<-EOT + ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, + in the order they appear in the list. New attributes are appended to the + end of the list. The elements of the list are joined by the `delimiter` + and treated as a single ID element. + EOT +} + +variable "labels_as_tags" { + type = set(string) + default = ["default"] + description = <<-EOT + Set of labels (ID elements) to include as tags in the `tags` output. + Default is to include all labels. + Tags with empty values will not be included in the `tags` output. + Set to `[]` to suppress all generated tags. + **Notes:** + The value of the `name` tag, if included, will be the `id`, not the `name`. + Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be + changed in later chained modules. Attempts to change it will be silently ignored. + EOT +} + +variable "tags" { + type = map(string) + default = {} + description = <<-EOT + Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). + Neither the tag keys nor the tag values will be modified by this module. + EOT +} + +variable "additional_tag_map" { + type = map(string) + default = {} + description = <<-EOT + Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. + This is for some rare cases where resources want additional configuration of tags + and therefore take a list of maps with tag key, value, and additional configuration. + EOT +} + +variable "label_order" { + type = list(string) + default = null + description = <<-EOT + The order in which the labels (ID elements) appear in the `id`. + Defaults to ["namespace", "environment", "stage", "name", "attributes"]. + You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. + EOT +} + +variable "regex_replace_chars" { + type = string + default = null + description = <<-EOT + Terraform regular expression (regex) string. + Characters matching the regex will be removed from the ID elements. + If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. + EOT +} + +variable "id_length_limit" { + type = number + default = null + description = <<-EOT + Limit `id` to this many characters (minimum 6). + Set to `0` for unlimited length. + Set to `null` for keep the existing setting, which defaults to `0`. + Does not affect `id_full`. + EOT + validation { + condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 + error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." + } +} + +variable "label_key_case" { + type = string + default = null + description = <<-EOT + Controls the letter case of the `tags` keys (label names) for tags generated by this module. + Does not affect keys of tags passed in via the `tags` input. + Possible values: `lower`, `title`, `upper`. + Default value: `title`. + EOT + + validation { + condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) + error_message = "Allowed values: `lower`, `title`, `upper`." + } +} + +variable "label_value_case" { + type = string + default = null + description = <<-EOT + Controls the letter case of ID elements (labels) as included in `id`, + set as tag values, and output by this module individually. + Does not affect values of tags passed in via the `tags` input. + Possible values: `lower`, `title`, `upper` and `none` (no transformation). + Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. + Default value: `lower`. + EOT + + validation { + condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) + error_message = "Allowed values: `lower`, `title`, `upper`, `none`." + } +} + +variable "descriptor_formats" { + type = any + default = {} + description = <<-EOT + Describe additional descriptors to be output in the `descriptors` output map. + Map of maps. Keys are names of descriptors. Values are maps of the form + `{ + format = string + labels = list(string) + }` + (Type is `any` so the map values can later be enhanced to provide additional options.) + `format` is a Terraform format string to be passed to the `format()` function. + `labels` is a list of labels, in order, to pass to `format()` function. + Label values will be normalized before being passed to `format()` so they will be + identical to how they appear in `id`. + Default is `{}` (`descriptors` output will be empty). + EOT +} \ No newline at end of file diff --git a/examples/complete/main.tf b/examples/complete/main.tf new file mode 100755 index 0000000..d8a9bd2 --- /dev/null +++ b/examples/complete/main.tf @@ -0,0 +1,28 @@ +locals { + name = "tf-example-complete-${random_string.example_random_suffix.result}" + tags = { tf_module = "cruxstack/cognito-userpool/aws", tf_module_example = "complete" } +} + +# ================================================================== example === + +module "congito_userpool" { + source = "../../" + + context = module.example_label.context # not required +} + +# ===================================================== supporting-resources === + +module "example_label" { + source = "cloudposse/label/null" + version = "0.25.0" + + name = local.name + tags = local.tags +} + +resource "random_string" "example_random_suffix" { + length = 6 + special = false + upper = false +} diff --git a/examples/complete/output.tf b/examples/complete/output.tf new file mode 100644 index 0000000..b5a2377 --- /dev/null +++ b/examples/complete/output.tf @@ -0,0 +1,29 @@ +output "id" { + description = "ID of the userpool." + value = module.congito_userpool.id +} + +output "arn" { + description = "ARN of the userpool." + value = module.congito_userpool.arn +} + +output "name" { + description = "Name of the userpool." + value = module.congito_userpool.name +} + +output "endpoint" { + description = "Endpoint name of the userpool." + value = module.congito_userpool.endpoint +} + +output "creation_date" { + description = "Date the userpool was created." + value = module.congito_userpool.creation_date +} + +output "last_modified_date" { + description = "Date the userpool was last modified." + value = module.congito_userpool.last_modified_date +} diff --git a/examples/complete/provider.tf b/examples/complete/provider.tf new file mode 100755 index 0000000..c125940 --- /dev/null +++ b/examples/complete/provider.tf @@ -0,0 +1,3 @@ +provider "aws" { + region = "us-east-1" +} diff --git a/examples/complete/version.tf b/examples/complete/version.tf new file mode 100644 index 0000000..f2702bf --- /dev/null +++ b/examples/complete/version.tf @@ -0,0 +1,7 @@ +terraform { + required_providers { + aws = { + source = "hashicorp/aws" + } + } +} diff --git a/main.tf b/main.tf new file mode 100755 index 0000000..833d2a3 --- /dev/null +++ b/main.tf @@ -0,0 +1,163 @@ +locals { + enabled = coalesce(var.enabled, module.this.enabled, true) + name = coalesce(var.name, module.this.name, "idp-${random_string.cognito_userpool_random_suffix.result}") +} + +# -------------------------------------------------------------------- label --- + +module "cognito_userpool_label" { + source = "cloudposse/label/null" + version = "0.25.0" + + enabled = local.enabled + name = local.name + context = module.this.context +} + +# only appliable if name variable was not set +resource "random_string" "cognito_userpool_random_suffix" { + length = 6 + special = false + upper = false +} + +# ================================================================= userpool === + +resource "aws_cognito_user_pool" "this" { + count = local.enabled ? 1 : 0 + + name = module.cognito_userpool_label.id + alias_attributes = var.alias_attributes + auto_verified_attributes = var.auto_verified_attributes + email_verification_subject = coalesce(var.email_verification_subject, var.admin_create_user_config.email_subject) + email_verification_message = coalesce(var.email_verification_message, var.admin_create_user_config.email_message) + mfa_configuration = upper(var.mfa_config) + sms_authentication_message = var.sms_authentication_message + sms_verification_message = var.sms_verification_message + username_attributes = var.username_attributes + deletion_protection = var.deletion_protection ? "ACTIVE" : "INACTIVE" + + admin_create_user_config { + allow_admin_create_user_only = var.admin_create_user_config.allow_admin_create_user_only + invite_message_template { + email_message = var.admin_create_user_config.email_message + email_subject = var.admin_create_user_config.email_subject + sms_message = var.admin_create_user_config.sms_message + } + } + + device_configuration { + challenge_required_on_new_device = var.device_config.challenge_required_on_new_device + device_only_remembered_on_user_prompt = var.device_config.device_only_remembered_on_user_prompt + } + + email_configuration { + configuration_set = var.email_config.configuration_set + reply_to_email_address = var.email_config.reply_to_email_address + source_arn = var.email_config.source_arn + email_sending_account = var.email_config.email_sending_account + from_email_address = var.email_config.from_email_address + } + + lambda_config { + create_auth_challenge = var.lambda_config.create_auth_challenge + custom_message = var.lambda_config.custom_message + define_auth_challenge = var.lambda_config.define_auth_challenge + post_authentication = var.lambda_config.post_authentication + post_confirmation = var.lambda_config.post_confirmation + pre_authentication = var.lambda_config.pre_authentication + pre_sign_up = var.lambda_config.pre_sign_up + pre_token_generation = var.lambda_config.pre_token_generation + user_migration = var.lambda_config.user_migration + verify_auth_challenge_response = var.lambda_config.verify_auth_challenge_response + kms_key_id = var.lambda_config.kms_key_id + + dynamic "custom_email_sender" { + for_each = coalesce(var.lambda_config.custom_email_sender.lambda_arn, "__UNSET__") != "__UNSET__" ? [true] : [] + content { + lambda_arn = var.lambda_config.custom_email_sender.lambda_arn + lambda_version = var.lambda_config.custom_email_sender.lambda_version + } + } + + dynamic "custom_sms_sender" { + for_each = coalesce(var.lambda_config.custom_sms_sender.lambda_arn, "__UNSET__") != "__UNSET__" ? [true] : [] + content { + lambda_arn = var.lambda_config.custom_sms_sender.lambda_arn + lambda_version = var.lambda_config.custom_sms_sender.lambda_version + } + } + } + + password_policy { + minimum_length = var.password_policy.minimum_length + require_lowercase = var.password_policy.require_lowercase + require_numbers = var.password_policy.require_numbers + require_symbols = var.password_policy.require_symbols + require_uppercase = var.password_policy.require_uppercase + temporary_password_validity_days = var.password_policy.temporary_password_validity_days + } + + user_attribute_update_settings { + attributes_require_verification_before_update = try(coalescelist(var.user_attribute_update_settings.attributes_require_verification_before_update, var.auto_verified_attributes, []), []) + } + + username_configuration { + case_sensitive = var.username_config.case_sensitive + } + + verification_message_template { + default_email_option = var.verification_message_template.default_email_option + email_message_by_link = var.verification_message_template.email_message_by_link + email_subject_by_link = var.verification_message_template.email_subject_by_link + } + + dynamic "account_recovery_setting" { + for_each = length(var.recovery_mechanisms) == 0 ? [] : [1] + content { + dynamic "recovery_mechanism" { + for_each = var.recovery_mechanisms + content { + name = lookup(recovery_mechanism.value, "name") + priority = lookup(recovery_mechanism.value, "priority") + } + } + } + } + + dynamic "schema" { + for_each = var.user_attribute_schemas + + content { + name = schema.key + attribute_data_type = schema.value + developer_only_attribute = schema.value + mutable = schema.value + required = schema.value + } + } + + dynamic "sms_configuration" { + for_each = coalesce(var.sms_config.sns_caller_arn, "__UNSET__") != "__UNSET__" ? [true] : [] + content { + external_id = var.sms_config.external_id + sns_caller_arn = var.sms_config.sns_caller_arn + } + } + + dynamic "software_token_mfa_configuration" { + for_each = upper(var.mfa_config) != "OFF" ? [true] : [] + content { + enabled = var.software_token_mfa_config.enabled + } + } + + dynamic "user_pool_add_ons" { + for_each = upper(var.userpool_add_ons.advanced_security_mode) != "OFF" ? [true] : [] + content { + advanced_security_mode = upper(var.userpool_add_ons.advanced_security_mode) + } + } + + tags = module.cognito_userpool_label.tags +} diff --git a/outputs.tf b/outputs.tf new file mode 100755 index 0000000..91db517 --- /dev/null +++ b/outputs.tf @@ -0,0 +1,29 @@ +output "id" { + description = "ID of the userpool." + value = local.enabled ? aws_cognito_user_pool.this[0].id : null +} + +output "arn" { + description = "ARN of the userpool." + value = local.enabled ? aws_cognito_user_pool.this[0].arn : null +} + +output "name" { + description = "Name of the userpool." + value = local.enabled ? aws_cognito_user_pool.this[0].name : null +} + +output "endpoint" { + description = "Endpoint name of the userpool." + value = local.enabled ? aws_cognito_user_pool.this[0].endpoint : null +} + +output "creation_date" { + description = "Date the userpool was created." + value = local.enabled ? aws_cognito_user_pool.this[0].creation_date : null +} + +output "last_modified_date" { + description = "Date the userpool was last modified." + value = local.enabled ? aws_cognito_user_pool.this[0].last_modified_date : null +} diff --git a/variables.tf b/variables.tf new file mode 100755 index 0000000..af130c5 --- /dev/null +++ b/variables.tf @@ -0,0 +1,238 @@ +# ================================================================= userpool === + +variable "email_config" { + type = object({ + configuration_set = optional(string) + email_sending_account = optional(string, "COGNITO_DEFAULT") + from_email_address = optional(string) + reply_to_email_address = optional(string, "") + source_arn = optional(string, "") + verification_message = optional(string, "") + verification_subject = optional(string, "") + }) + description = "Configuration email from the userpool." + default = {} +} + +variable "email_verification_message" { + type = string + description = "A string representing the email verification message" + default = "" +} + +variable "email_verification_subject" { + type = string + description = "A string representing the email verification subject" + default = "" +} + +variable "admin_create_user_config" { + type = object({ + allow_admin_create_user_only = optional(bool, true) + email_message = optional(string, "{username}, your verification code is `{####}`") + email_subject = optional(string, "Your verification code") + sms_message = optional(string, "Your username is {username} and temporary password is `{####}`") + }) + description = "The configuration for AdminCreateUser requests" + default = {} +} + +variable "alias_attributes" { + type = list(string) + description = <<-EOF + Attributes supported as an alias for this userpool. Possible values: phone_number, email, or preferred_username. + Conflicts with `username_attributes`. + EOF + default = [] + + validation { + condition = alltrue([for x in var.alias_attributes : contains(["phone_number", "email", "preferred_username"], lower(x))]) + error_message = "The `alias_attributes` must be one or more of `phone_number`, `email`, or `preferred_username`." + } +} + +variable "username_attributes" { + type = list(string) + description = <<-EOF + Specifies whether email addresses or phone numbers can be specified as usernames when a user signs up. Conflicts + with `alias_attributes`. + EOF + default = null +} + +variable "deletion_protection" { + type = bool + description = <<-EOF + When `true`, it prevents accidental deletion of your userpool. Before you can delete a userpool that you have + protected against deletion, you must set this to `false`. + EOF + default = true +} + +variable "auto_verified_attributes" { + type = list(string) + description = "The attributes to be auto-verified. Possible values: `email`, `phone_number`." + default = [] +} + +variable "device_config" { + type = object({ + challenge_required_on_new_device = optional(bool, false) + device_only_remembered_on_user_prompt = optional(bool, false) + }) + description = "The configuration for the userpool's device tracking." + default = {} +} + +variable "lambda_config" { + type = object({ + create_auth_challenge = optional(string) + custom_message = optional(string) + define_auth_challenge = optional(string) + post_authentication = optional(string) + post_confirmation = optional(string) + pre_authentication = optional(string) + pre_sign_up = optional(string) + pre_token_generation = optional(string) + user_migration = optional(string) + verify_auth_challenge_response = optional(string) + kms_key_id = optional(string) + custom_email_sender = optional(object({ + lambda_arn = optional(string) + lambda_version = optional(string, "V1_0") + }), {}) + custom_sms_sender = optional(object({ + lambda_arn = optional(string) + lambda_version = optional(string, "V1_0") + }), {}) + }) + description = "Configuration any AWS Lambda triggers associated with the userpool." + default = {} + + validation { + condition = !(coalesce(var.lambda_config.kms_key_id, "__UNSET__") == "__UNSET__" && (coalesce(var.lambda_config.custom_sms_sender.lambda_arn, "__UNSET__") != "__UNSET__" || coalesce(var.lambda_config.custom_sms_sender.lambda_arn, "__UNSET__") != "__UNSET__")) + error_message = "The `kms_key_id` must be set when using configuring either `custom_sms_sender` or `custom_email_sender` triggers." + } +} + +variable "mfa_config" { + type = string + description = <<-EOF + Set to enable multi-factor authentication. Must be one of the following values: `ON`, `OFF`, or `OPTIONAL`. + EOF + default = "OFF" + + validation { + condition = contains(["ON", "OFF", "OPTIONAL"], upper(var.mfa_config)) + error_message = "The `mfa_config` must be one of `ON`, `OFF`, or `OPTIONAL`." + } +} + +variable "password_policy" { + type = object({ + minimum_length = optional(number, 8), + require_lowercase = optional(bool, true), + require_numbers = optional(bool, true), + require_symbols = optional(bool, true), + require_uppercase = optional(bool, true), + temporary_password_validity_days = optional(number, 7) + }) + description = "A container for information about the userpool password policy." + default = {} +} + +variable "recovery_mechanisms" { + type = list(string) + description = "List of account reecovery options." + default = [] +} + +variable "sms_config" { + type = object({ + external_id = optional(string, "") + sns_caller_arn = optional(string, "") + }) + description = "Configuration for SMS" + default = {} +} + +variable "sms_authentication_message" { + type = string + description = "A string representing the SMS authentication message." + default = "Your code is {####}" +} + +variable "sms_verification_message" { + type = string + description = "A string representing the SMS verification message." + default = "Your code is {####}" +} + +variable "software_token_mfa_config" { + type = object({ + enabled = optional(bool, false) + }) + description = "Configuration for software token multi-factor authentication." + default = {} +} + +variable "user_attribute_schemas" { + type = map(object({ + required = optional(bool, false) + attribute_data_type = string + developer_only_attribute = optional(bool, false) + mutable = optional(bool, false) + number_attribute_constraints = optional(object({ + max_value = optional(string) + min_value = optional(string) + })) + string_attribute_constraints = optional(object({ + max_length = optional(string) + min_length = optional(string) + })) + })) + description = "Map of all user attribute schemas. The key is the attribute name." + default = {} +} + +variable "user_attribute_update_settings" { + type = object({ + attributes_require_verification_before_update = optional(list(string), []) + }) + description = "Configuration block for user attribute update settings." + default = {} + + validation { + condition = alltrue([for x in var.user_attribute_update_settings.attributes_require_verification_before_update : contains(["email", "phone_number"], lower(x))]) + error_message = "The `attributes_require_verification_before_update` must be a list of `email` and `phone_number`" + } +} + +variable "username_config" { + type = object({ + case_sensitive = optional(bool, true) + }) + description = <<-EOF + Configuration for sername. Setting `case_sensitive` specifies whether username case sensitivity will be applied for + all users in the userpool through Cognito APIs. + EOF + default = {} +} + +variable "userpool_add_ons" { + type = object({ + advanced_security_mode = optional(string, "off") + }) + description = "Configuration block for userpool add-ons to enable userpool advanced security mode features" + default = {} +} + +variable "verification_message_template" { + type = object({ + default_email_option = optional(string, "CONFIRM_WITH_CODE") + email_message_by_link = optional(string, "{##Click Here##}") + email_subject_by_link = optional(string, "Your verification code") + }) + description = "Configuration for verification message templates." + default = {} +} diff --git a/version.tf b/version.tf new file mode 100755 index 0000000..b5df4ee --- /dev/null +++ b/version.tf @@ -0,0 +1,10 @@ +terraform { + required_version = ">= 1.3.0" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.0.0, < 6.0.0" + } + } +}