Skip to content

user-pool resource

Source: internal/service/cognitoidp/user_pool_types.go:139

Example usage:

imports: {
  aws-cognitoidp: 'github.com/cloudboss/unobin-library-aws//service/cognitoidp'
}

resources: {
  example: aws-cognitoidp.user-pool {
    # Set input fields here.
  }
}

Inputs

name

string

required

account-recovery-setting

optional(object) 
optional(
  object({
    recovery-mechanisms: list(
      object({
        name: string
        priority: integer
      })
    )
  })
)

admin-create-user-config

optional(object) 
optional(
  object({
    allow-admin-create-user-only: optional(boolean)
    invite-message-template: optional(
      object({
        email-message: optional(string)
        email-subject: optional(string)
        sms-message: optional(string)
      })
    )
    unused-account-validity-days: optional(integer)
  })
)

alias-attributes

optional(list(string))

auto-verified-attributes

optional(list(string))

deletion-protection

optional(string)

device-configuration

optional(object) 
optional(
  object({
    challenge-required-on-new-device: optional(boolean)
    device-only-remembered-on-user-prompt: optional(boolean)
  })
)

email-configuration

optional(object) 
optional(
  object({
    configuration-set: optional(string)
    email-sending-account: optional(string)
    from-email-address: optional(string)
    reply-to-email-address: optional(string)
    source-arn: optional(string)
  })
)

email-verification-message

optional(string)

email-verification-subject

optional(string)

lambda-config

optional(object) 
optional(
  object({
    create-auth-challenge: optional(string)
    custom-email-sender: optional(
      object({
        lambda-arn: string
        lambda-version: string
      })
    )
    custom-message: optional(string)
    custom-sms-sender: optional(
      object({
        lambda-arn: string
        lambda-version: string
      })
    )
    define-auth-challenge: optional(string)
    inbound-federation: optional(
      object({
        lambda-arn: string
        lambda-version: string
      })
    )
    kms-key-id: optional(string)
    post-authentication: optional(string)
    post-confirmation: optional(string)
    pre-authentication: optional(string)
    pre-sign-up: optional(string)
    pre-token-generation: optional(string)
    pre-token-generation-config: optional(
      object({
        lambda-arn: string
        lambda-version: string
      })
    )
    user-migration: optional(string)
    verify-auth-challenge-response: optional(string)
  })
)

mfa-configuration

optional(string)

enabled-mfas

optional(list(string))

email-mfa-configuration

optional(object) 
optional(
  object({
    message: optional(string)
    subject: optional(string)
  })
)

password-policy

optional(object) 
optional(
  object({
    minimum-length: optional(integer)
    password-history-size: optional(integer)
    require-lowercase: optional(boolean)
    require-numbers: optional(boolean)
    require-symbols: optional(boolean)
    require-uppercase: optional(boolean)
    temporary-password-validity-days: optional(integer)
  })
)

sign-in-policy

optional(object) 
optional(
  object({
    allowed-first-auth-factors: optional(list(string))
  })
)

schema

optional(list(object)) 
optional(
  list(
    object({
      attribute-data-type: string
      developer-only-attribute: optional(boolean)
      mutable: optional(boolean)
      name: string
      number-attribute-constraints: optional(
        object({
          max-value: optional(string)
          min-value: optional(string)
        })
      )
      required: optional(boolean)
      string-attribute-constraints: optional(
        object({
          max-length: optional(string)
          min-length: optional(string)
        })
      )
    })
  )
)

sms-authentication-message

optional(string)

sms-configuration

optional(object) 
optional(
  object({
    sns-caller-arn: string
    external-id: optional(string)
    sns-region: optional(string)
  })
)

sms-verification-message

optional(string)

tags

optional(map(string))

user-attribute-update-settings

optional(object) 
optional(
  object({
    attributes-require-verification-before-update: list(string)
  })
)

user-pool-add-ons

optional(object) 
optional(
  object({
    advanced-security-additional-flows: optional(
      object({
        custom-auth-mode: optional(string)
      })
    )
    advanced-security-mode: string
  })
)

user-pool-tier

optional(string)

username-attributes

optional(list(string))

username-configuration

optional(object) 
optional(
  object({
    case-sensitive: boolean
  })
)

verification-message-template

optional(object) 
optional(
  object({
    default-email-option: optional(string)
    email-message: optional(string)
    email-message-by-link: optional(string)
    email-subject: optional(string)
    email-subject-by-link: optional(string)
    sms-message: optional(string)
  })
)

web-authn-configuration

optional(object) 
optional(
  object({
    factor-configuration: optional(string)
    relying-party-id: optional(string)
    user-verification: optional(string)
  })
)

Input Constraints

Name rules

name must contain at least 1 character.

Rule logic
Require
@core.length(input.name) >= 1

name must contain at most 128 characters.

Rule logic
Require
@core.length(input.name) <= 128

Alias attributes rules

alias-attributes holds at most 3 entries.

Rule logic
Require
@core.length(input.alias-attributes ?? []) <= 3

alias-attributes values must be valid alias attributes.

Rule logic
For each
input.alias-attributes ?? []
Require
@each.value == 'email'
|| @each.value == 'phone_number'
|| @each.value == 'preferred_username'

Username attributes rules

username-attributes holds at most 2 entries.

Rule logic
Require
@core.length(input.username-attributes ?? []) <= 2

username-attributes values must be email or phone_number.

Rule logic
For each
input.username-attributes ?? []
Require
@each.value == 'email'
|| @each.value == 'phone_number'

Field combinations

alias-attributes conflicts with username-attributes.

unused-account-validity-days conflicts with temporary-password-validity-days.

Auto verified attributes rules

auto-verified-attributes holds at most 2 entries.

Rule logic
Require
@core.length(input.auto-verified-attributes ?? []) <= 2

auto-verified-attributes values must be email or phone_number.

Rule logic
For each
input.auto-verified-attributes ?? []
Require
@each.value == 'email'
|| @each.value == 'phone_number'

Deletion protection rules

deletion-protection must be ACTIVE or INACTIVE.

Rule logic
When
input.deletion-protection != null
Require
input.deletion-protection == 'ACTIVE'
|| input.deletion-protection == 'INACTIVE'

Account recovery setting rules

recovery-mechanisms must contain 1 or 2 entries.

Rule logic
When
input.account-recovery-setting != null
Require
(input.account-recovery-setting.recovery-mechanisms == null || @core.length(input.account-recovery-setting.recovery-mechanisms) >= 1)
&& @core.length(input.account-recovery-setting.recovery-mechanisms ?? []) <= 2

recovery mechanism name is invalid.

Rule logic
For each
input.account-recovery-setting.recovery-mechanisms ?? []
Require
@each.value.name == 'admin_only'
|| @each.value.name == 'verified_email'
|| @each.value.name == 'verified_phone_number'

recovery mechanism priority must be 1 or 2.

Rule logic
For each
input.account-recovery-setting.recovery-mechanisms ?? []
Require
@each.value.priority >= 1
&& @each.value.priority <= 2

Admin create user config rules

unused-account-validity-days must be between 0 and 365.

Rule logic
When
input.admin-create-user-config.unused-account-validity-days != null
Require
input.admin-create-user-config.unused-account-validity-days >= 0
&& input.admin-create-user-config.unused-account-validity-days <= 365

Email configuration rules

email-sending-account must be COGNITO_DEFAULT or DEVELOPER.

Rule logic
When
input.email-configuration.email-sending-account != null
Require
input.email-configuration.email-sending-account == 'COGNITO_DEFAULT'
|| input.email-configuration.email-sending-account == 'DEVELOPER'

Lambda config rules

custom-email-sender lambda-version must be V1_0.

Rule logic
When
input.lambda-config.custom-email-sender != null
Require
input.lambda-config.custom-email-sender.lambda-version == 'V1_0'

custom-sms-sender lambda-version must be V1_0.

Rule logic
When
input.lambda-config.custom-sms-sender != null
Require
input.lambda-config.custom-sms-sender.lambda-version == 'V1_0'

pre-token-generation-config lambda-version is invalid.

Rule logic
When
input.lambda-config.pre-token-generation-config != null
Require
input.lambda-config.pre-token-generation-config.lambda-version == 'V1_0'
|| input.lambda-config.pre-token-generation-config.lambda-version == 'V2_0'
|| input.lambda-config.pre-token-generation-config.lambda-version == 'V3_0'

inbound-federation lambda-version must be V1_0.

Rule logic
When
input.lambda-config.inbound-federation != null
Require
input.lambda-config.inbound-federation.lambda-version == 'V1_0'

custom senders require kms-key-id.

Rule logic
When
input.lambda-config.custom-email-sender != null
|| input.lambda-config.custom-sms-sender != null
Require
input.lambda-config.kms-key-id != null

pre-token-generation Lambda ARNs must match.

Rule logic
When
input.lambda-config.pre-token-generation != null
&& input.lambda-config.pre-token-generation-config != null
Require
input.lambda-config.pre-token-generation-config.lambda-arn == input.lambda-config.pre-token-generation

Mfa configuration rules

mfa-configuration must be OFF, ON, or OPTIONAL.

Rule logic
When
input.mfa-configuration != null
Require
input.mfa-configuration == 'OFF'
|| input.mfa-configuration == 'ON'
|| input.mfa-configuration == 'OPTIONAL'

ON or OPTIONAL MFA requires an enabled factor.

Rule logic
When
input.mfa-configuration == 'ON'
|| input.mfa-configuration == 'OPTIONAL'
Require
@core.length(input.enabled-mfas ?? []) >= 1
|| input.web-authn-configuration.factor-configuration == 'MULTI_FACTOR_WITH_USER_VERIFICATION'

OFF MFA forbids enabled factors.

Rule logic
When
input.mfa-configuration == null
|| input.mfa-configuration == 'OFF'
Require
@core.length(input.enabled-mfas ?? []) <= 0
&& !(input.web-authn-configuration.factor-configuration == 'MULTI_FACTOR_WITH_USER_VERIFICATION')

Enabled mfas rules

enabled-mfas holds at most 3 entries.

Rule logic
Require
@core.length(input.enabled-mfas ?? []) <= 3

enabled-mfas contains an invalid factor.

Rule logic
For each
input.enabled-mfas ?? []
Require
@each.value == 'SMS_MFA'
|| @each.value == 'EMAIL_OTP'
|| @each.value == 'SOFTWARE_TOKEN_MFA'

Web authn configuration rules

web-authn factor-configuration is invalid.

Rule logic
When
input.web-authn-configuration.factor-configuration != null
Require
input.web-authn-configuration.factor-configuration == 'SINGLE_FACTOR'
|| input.web-authn-configuration.factor-configuration == 'MULTI_FACTOR_WITH_USER_VERIFICATION'

web-authn user-verification must be required or preferred.

Rule logic
When
input.web-authn-configuration.user-verification != null
Require
input.web-authn-configuration.user-verification == 'required'
|| input.web-authn-configuration.user-verification == 'preferred'

web-authn relying-party-id must be 1 to 63 characters.

Rule logic
When
input.web-authn-configuration.relying-party-id != null
Require
@core.length(input.web-authn-configuration.relying-party-id) >= 1
&& @core.length(input.web-authn-configuration.relying-party-id) <= 63

multi-factor WebAuthn requires verification and an eligible tier.

Rule logic
When
input.web-authn-configuration.factor-configuration == 'MULTI_FACTOR_WITH_USER_VERIFICATION'
Require
input.web-authn-configuration.user-verification == 'required'
&& ((input.user-pool-tier == null) || (input.user-pool-tier == 'ESSENTIALS' || input.user-pool-tier == 'PLUS'))

Password policy rules

password minimum-length must be between 6 and 99.

Rule logic
When
input.password-policy.minimum-length != null
Require
input.password-policy.minimum-length >= 6
&& input.password-policy.minimum-length <= 99

password-history-size must be between 0 and 24.

Rule logic
When
input.password-policy.password-history-size != null
Require
input.password-policy.password-history-size >= 0
&& input.password-policy.password-history-size <= 24

temporary-password-validity-days must be between 0 and 365.

Rule logic
When
input.password-policy.temporary-password-validity-days != null
Require
input.password-policy.temporary-password-validity-days >= 0
&& input.password-policy.temporary-password-validity-days <= 365

password history requires advanced security.

Rule logic
When
input.password-policy.password-history-size != null
&& (input.password-policy.password-history-size == null || input.password-policy.password-history-size > 0)
Require
input.user-pool-add-ons.advanced-security-mode == 'AUDIT'
|| input.user-pool-add-ons.advanced-security-mode == 'ENFORCED'

Sign in policy rules

allowed-first-auth-factors must contain 1 to 4 entries.

Rule logic
When
input.sign-in-policy != null
Require
(input.sign-in-policy.allowed-first-auth-factors == null || @core.length(input.sign-in-policy.allowed-first-auth-factors) >= 1)
&& @core.length(input.sign-in-policy.allowed-first-auth-factors ?? []) <= 4

allowed-first-auth-factors contains an invalid factor.

Rule logic
For each
input.sign-in-policy.allowed-first-auth-factors ?? []
Require
@each.value == 'PASSWORD'
|| @each.value == 'EMAIL_OTP'
|| @each.value == 'SMS_OTP'
|| @each.value == 'WEB_AUTHN'

sign-in-policy requires user-pool-tier ESSENTIALS or PLUS.

Rule logic
When
input.sign-in-policy != null
Require
input.user-pool-tier == null
|| (input.user-pool-tier == 'ESSENTIALS' || input.user-pool-tier == 'PLUS')

Schema rules

schema must contain 1 to 50 attributes.

Rule logic
When
input.schema != null
Require
@core.length(input.schema) >= 1
&& @core.length(input.schema) <= 50

schema attribute-data-type is invalid.

Rule logic
For each
input.schema ?? []
Require
@each.value.attribute-data-type == 'String'
|| @each.value.attribute-data-type == 'Number'
|| @each.value.attribute-data-type == 'DateTime'
|| @each.value.attribute-data-type == 'Boolean'

string-attribute-constraints requires String.

Rule logic
For each
input.schema ?? []
When
@each.value.string-attribute-constraints != null
Require
@each.value.attribute-data-type == 'String'

number-attribute-constraints requires Number.

Rule logic
For each
input.schema ?? []
When
@each.value.number-attribute-constraints != null
Require
@each.value.attribute-data-type == 'Number'

Verification message template rules

default-email-option must be CONFIRM_WITH_CODE or CONFIRM_WITH_LINK.

Rule logic
When
input.verification-message-template.default-email-option != null
Require
input.verification-message-template.default-email-option == 'CONFIRM_WITH_CODE'
|| input.verification-message-template.default-email-option == 'CONFIRM_WITH_LINK'

User attribute update settings rules

attributes-require-verification-before-update holds at most 2 entries.

Rule logic
Require
@core.length(input.user-attribute-update-settings.attributes-require-verification-before-update ?? []) <= 2

verification attributes must be email or phone_number.

Rule logic
For each
input.user-attribute-update-settings.attributes-require-verification-before-update ?? []
Require
@each.value == 'email'
|| @each.value == 'phone_number'

User pool add ons rules

advanced-security-mode must be OFF, AUDIT, or ENFORCED.

Rule logic
When
input.user-pool-add-ons != null
Require
input.user-pool-add-ons.advanced-security-mode == 'OFF'
|| input.user-pool-add-ons.advanced-security-mode == 'AUDIT'
|| input.user-pool-add-ons.advanced-security-mode == 'ENFORCED'

custom-auth-mode must be AUDIT or ENFORCED.

Rule logic
When
input.user-pool-add-ons.advanced-security-additional-flows.custom-auth-mode != null
Require
input.user-pool-add-ons.advanced-security-additional-flows.custom-auth-mode == 'AUDIT'
|| input.user-pool-add-ons.advanced-security-additional-flows.custom-auth-mode == 'ENFORCED'

advanced security requires user-pool-tier PLUS.

Rule logic
When
input.user-pool-add-ons != null
&& input.user-pool-add-ons.advanced-security-mode != 'OFF'
Require
input.user-pool-tier == 'PLUS'

User pool tier rules

user-pool-tier must be LITE, ESSENTIALS, or PLUS.

Rule logic
When
input.user-pool-tier != null
Require
input.user-pool-tier == 'LITE'
|| input.user-pool-tier == 'ESSENTIALS'
|| input.user-pool-tier == 'PLUS'

Tags rules

tags holds at most 50 entries.

Rule logic
Require
@core.length(input.tags ?? {}) <= 50

Outputs

user-pool-id

string

arn

string

provider-name

string

provider-url

string

endpoint

string

creation-date

string

last-modified-date

string

domain

string

custom-domain

string

estimated-number-of-users

integer

user-pool-tier

string