It's a library for creating AWS Cognito resources. It creates an user pool, identity pool, a client application, and others resources.
pnpm add @ttoss/cloud-auth
Create a cloudformation.ts
file in your project and export the template:
import { createAuthTemplate } from '@ttoss/cloud-auth';
const template = createAuthTemplate();
export default template;
const template = createAuthTemplate({
identityPool: {
enabled: true, // false by default
name: 'MyIdentityPool',
allowUnauthenticatedIdentities: false, // false by default
},
});
const template = createAuthTemplate({
identityPool: {
enabled: true,
authenticatedRoleArn:
'arn:aws:iam::123456789012:role/MyIdentityPool_AuthenticatedRole',
unauthenticatedRoleArn:
'arn:aws:iam::123456789012:role/MyIdentityPool_UnauthenticatedRole',
},
});
const template = createAuthTemplate({
identityPool: {
enabled: true,
authenticatedPolicies: [
{
policyName: 'MyIdentityPool_AuthenticatedPolicy',
policyDocument: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Allow',
Action: ['mobileanalytics:PutEvents', 'cognito-sync:*'],
Resource: ['*'],
},
],
},
},
],
unauthenticatedPolicies: [
{
policyName: 'MyIdentityPool_UnauthenticatedPolicy',
policyDocument: {
Version: '2012-10-17',
Statement: [
{
Effect: 'Deny',
Action: ['*'],
Resource: ['*'],
},
],
},
},
],
},
});
When you enable the identity pool, it maps the following principal tags to handle access control by default:
PrincipalTags:
appClientId: 'aud'
userId: 'sub'
This way you can use the appClientId
and userId
tags in your IAM policies by controlling access for IAM principals. For example:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject*",
"Resource": "arn:aws:s3:::*-${aws:PrincipalTag/userId}/*"
}
]
}
You can change the default tags by passing the principalTags
property and other tokens:
const template = createAuthTemplate({
identityPool: {
enabled: true,
principalTags: {
appId: 'aud',
username: 'sub',
name: 'name',
},
},
});
If you want to disable the principal tags, you can pass the principalTags
property with false
value:
const template = createAuthTemplate({
identityPool: {
enabled: true,
principalTags: false,
},
});