SampleInfrastructure.template.yaml

AWSTemplateFormatVersion: 2010-09-09
Resources:
  LambdaForCloudFormation:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: LambdaForCloudFormation
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Action: 'sts:AssumeRole'
            Principal:
              Service: lambda.amazonaws.com
      Policies:
        -
          PolicyName: WriteCloudWatchLogs
          PolicyDocument: 
            Version: '2012-10-17'
            Statement: 
              -
                Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource: 'arn:aws:logs:*:*:*'
        -
          PolicyName: UpdateUserPoolClient
          PolicyDocument: 
            Version: '2012-10-17'
            Statement: 
              -
                Effect: Allow
                Action: 'cognito-idp:UpdateUserPoolClient'
                Resource: 'arn:aws:cognito-idp:*:*:userpool/*'
        -
          PolicyName: ManageUserPoolDomain
          PolicyDocument: 
            Version: '2012-10-17'
            Statement: 
              -
                Effect: Allow
                Action: 'cognito-idp:CreateUserPoolDomain'
                Resource: 'arn:aws:cognito-idp:*:*:userpool/*'
              -
                Effect: Allow
                Action: 'cognito-idp:DeleteUserPoolDomain'
                Resource: 'arn:aws:cognito-idp:*:*:userpool/*'
              -
                Effect: Allow
                Action: 'cognito-idp:DescribeUserPoolDomain'
                Resource: '*'
        -
          PolicyName: InvokeLambdaFunction
          PolicyDocument: 
            Version: '2012-10-17'
            Statement: 
              -
                Effect: Allow
                Action: 'lambda:InvokeFunction'
                Resource: 'arn:aws:lambda:*:*:function:*'
  CloudFormationSendResponse:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: CloudFormationSendResponse
      Runtime: nodejs8.10
      Code: ./CloudFormationSendResponse
      Handler: index.handler
      Role: !GetAtt LambdaForCloudFormation.Arn
  CloudFormationCognitoUserPoolClientSettings:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: CloudFormationCognitoUserPoolClientSettings
      Runtime: nodejs8.10
      Code: ./CloudFormationCognitoUserPoolClientSettings.js
      Handler: CloudFormationCognitoUserPoolClientSettings.handler
      Role: !GetAtt LambdaForCloudFormation.Arn
    DependsOn: CloudFormationSendResponse
  CloudFormationCognitoUserPoolDomain:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: CloudFormationCognitoUserPoolDomain
      Runtime: nodejs8.10
      Code: ./CloudFormationCognitoUserPoolDomain.js
      Handler: CloudFormationCognitoUserPoolDomain.handler
      Role: !GetAtt LambdaForCloudFormation.Arn
    DependsOn: CloudFormationSendResponse
  UserPoolTest:
    Type: 'AWS::Cognito::UserPool'
    Properties:
      UserPoolName: UserPoolTest
  UserPoolTestClient:
    Type: 'AWS::Cognito::UserPoolClient'
    Properties:
      ClientName: UserPoolTestClient
      GenerateSecret: true
      UserPoolId: !Ref UserPoolTest
  UserPoolTestClientSettings:
    Type: 'Custom::CognitoUserPoolClientSettings'
    Properties:
      ServiceToken: !GetAtt CloudFormationCognitoUserPoolClientSettings.Arn
      UserPoolId: !Ref UserPoolTest
      UserPoolClientId: !Ref UserPoolTestClient
      SupportedIdentityProviders:
        - COGNITO
      CallbackURL: 'https://www.amazon.com'
      LogoutURL: 'https://www.google.com'
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthFlows:
        - code
      AllowedOAuthScopes:
        - openid
  UserPoolTestDomain:
    Type: 'Custom::CognitoUserPoolDomain'
    Properties:
      ServiceToken: !GetAtt CloudFormationCognitoUserPoolDomain.Arn
      UserPoolId: !Ref UserPoolTest
      Domain: 'userpool-test-01'