SampleInfrastructure.template.yaml

AWSTemplateFormatVersion: 2010-09-09
Resources:
  LambdaForCloudFormation:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: LambdaForCloudFormation
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Action: 'sts:AssumeRole'
            Principal:
              Service: lambda.amazonaws.com
      Policies:
        -
          PolicyName: WriteCloudWatchLogs
          PolicyDocument: 
            Version: '2012-10-17'
            Statement: 
              -
                Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource: 'arn:aws:logs:*:*:*'
        -
          PolicyName: UpdateUserPoolClient
          PolicyDocument: 
            Version: '2012-10-17'
            Statement: 
              -
                Effect: Allow
                Action: 'cognito-idp:UpdateUserPoolClient'
                Resource: 'arn:aws:cognito-idp:*:*:userpool/*'
        -
          PolicyName: ManageUserPoolDomain
          PolicyDocument: 
            Version: '2012-10-17'
            Statement: 
              -
                Effect: Allow
                Action: 'cognito-idp:CreateUserPoolDomain'
                Resource: 'arn:aws:cognito-idp:*:*:userpool/*'
              -
                Effect: Allow
                Action: 'cognito-idp:DeleteUserPoolDomain'
                Resource: 'arn:aws:cognito-idp:*:*:userpool/*'
              -
                Effect: Allow
                Action: 'cognito-idp:DescribeUserPoolDomain'
                Resource: '*'
        -
          PolicyName: ManageUserPoolIdentityProviders
          PolicyDocument: 
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  - 'cognito-idp:CreateIdentityProvider'
                  - 'cognito-idp:DeleteIdentityProvider'
                Resource: 'arn:aws:cognito-idp:*:*:userpool/*'
              -
                Effect: Allow
                Action: 'cognito-idp:DescribeIdentityProvider'
                Resource: '*'
        -
          PolicyName: InvokeLambdaFunction
          PolicyDocument: 
            Version: '2012-10-17'
            Statement: 
              -
                Effect: Allow
                Action: 'lambda:InvokeFunction'
                Resource: 'arn:aws:lambda:*:*:function:*'
  CloudFormationSendResponse:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: CloudFormationSendResponse
      Runtime: nodejs8.10
      Code: ./CloudFormationSendResponse
      Handler: index.handler
      Role: !GetAtt LambdaForCloudFormation.Arn
  CloudFormationCognitoUserPoolClientSettings:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: CloudFormationCognitoUserPoolClientSettings
      Runtime: nodejs8.10
      Code: ./CloudFormationCognitoUserPoolClientSettings.js
      Handler: CloudFormationCognitoUserPoolClientSettings.handler
      Role: !GetAtt LambdaForCloudFormation.Arn
    DependsOn: CloudFormationSendResponse
  CloudFormationCognitoUserPoolDomain:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: CloudFormationCognitoUserPoolDomain
      Runtime: nodejs8.10
      Code: ./CloudFormationCognitoUserPoolDomain.js
      Handler: CloudFormationCognitoUserPoolDomain.handler
      Role: !GetAtt LambdaForCloudFormation.Arn
    DependsOn: CloudFormationSendResponse
  CloudFormationCognitoUserPoolIdentityProvider:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: CloudFormationCognitoUserPoolIdentityProvider
      Runtime: nodejs8.10
      Code: ./CloudFormationCognitoUserPoolIdentityProvider.js
      Handler: CloudFormationCognitoUserPoolIdentityProvider.handler
      Role: !GetAtt LambdaForCloudFormation.Arn
    DependsOn: CloudFormationSendResponse
  UserPoolTest:
    Type: 'AWS::Cognito::UserPool'
    Properties:
      UserPoolName: UserPoolTest
  UserPoolTestClient:
    Type: 'AWS::Cognito::UserPoolClient'
    Properties:
      ClientName: UserPoolTestClient
      GenerateSecret: true
      UserPoolId: !Ref UserPoolTest
  UserPoolTestClientSettings:
    Type: 'Custom::CognitoUserPoolClientSettings'
    Properties:
      ServiceToken: !GetAtt CloudFormationCognitoUserPoolClientSettings.Arn
      UserPoolId: !Ref UserPoolTest
      UserPoolClientId: !Ref UserPoolTestClient
      SupportedIdentityProviders:
        - COGNITO
      CallbackURL: 'https://www.amazon.com'
      LogoutURL: 'https://www.google.com'
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthFlows:
        - code
      AllowedOAuthScopes:
        - openid
  UserPoolTestDomain:
    Type: 'Custom::CognitoUserPoolDomain'
    Properties:
      ServiceToken: !GetAtt CloudFormationCognitoUserPoolDomain.Arn
      UserPoolId: !Ref UserPoolTest
      Domain: 'userpool-test-01'
  UserPoolTestIdentityProvider:
    Type: 'Custom::CognitoUserPoolIdentityProvider'
    Properties:
      ServiceToken: !GetAtt CloudFormationCognitoUserPoolIdentityProvider.Arn
      UserPoolId: !Ref UserPoolTest
      ProviderName: Google
      ProviderType: Google
      ProviderDetails:
        authorize_scopes: 'email openid'
        attributes_url_add_attributes: true
        token_url: 'https://www.googleapis.com/oauth2/v4/token'
        oidc_issuer: 'https://accounts.google.com'
        client_id: '123456789012-12345exampleexampleexampleexampl.apps.googleusercontent.com'
        attributes_url: 'https://people.googleapis.com/v1/people/me?personFields='
        client_secret: '1234567890exampleexample'
        token_request_method: 'POST'
      AttributeMapping:
        username: 'sub'
        email: 'email'