AtfCognitoProps

Defined in: packages/constructs/src/auth/cognito.ts:79

AtfCognitoProps extends Omit so every CDK UserPool prop is available directly. Axis controls a small set of props (naming, removalPolicy, base customAttributes, lambdaTriggers) — everything else passes straight through to CDK.

Extends

Omit<cognito.UserPoolProps, "userPoolName" | "customAttributes" | "lambdaTriggers" | "removalPolicy">

Properties

accountRecovery?

readonly optional accountRecovery?: AccountRecovery

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:766

How will a user be able to recover their account?

Default

AccountRecovery.PHONE_WITHOUT_MFA_AND_EMAIL

Inherited from

Omit.accountRecovery

advancedSecurityMode?

readonly optional advancedSecurityMode?: AdvancedSecurityMode

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:795

The user pool’s Advanced Security Mode

Default

- no value

Inherited from

Omit.advancedSecurityMode

autoVerify?

readonly optional autoVerify?: AutoVerifiedAttrs

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:673

Attributes which Cognito will look to verify automatically upon user sign up. EMAIL and PHONE are the only available options.

Default

If signInAlias includes email and/or phone, they will be included in autoVerifiedAttributes by default. If absent, no attributes will be auto-verified.

Inherited from

Omit.autoVerify

callbackUrls?

optional callbackUrls?: string[]

Defined in: packages/constructs/src/auth/cognito.ts:108

OAuth callback URLs for hosted UI

customSenderKmsKey?

readonly optional customSenderKmsKey?: IKeyRef

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:789

This key will be used to encrypt temporary passwords and authorization codes that Amazon Cognito generates.

See

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-sender-triggers.html

Default

- no key ID configured

Inherited from

Omit.customSenderKmsKey

customThreatProtectionMode?

readonly optional customThreatProtectionMode?: CustomThreatProtectionMode

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:826

The Type of Threat Protection Enabled for Custom Authentication

This feature only functions if your FeaturePlan is set to FeaturePlan.PLUS

See

https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html

Acceptable values are strings with values ‘ENFORCED’, or ‘AUDIT’. For ‘OFF’ behavior, don’t define this value

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-userpooladdons.html

Default

- no value

Inherited from

Omit.customThreatProtectionMode

deletionProtection?

readonly optional deletionProtection?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:778

Indicates whether the user pool should have deletion protection enabled.

Default

false

Inherited from

Omit.deletionProtection

deviceTracking?

readonly optional deviceTracking?: DeviceTracking

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:783

Device tracking settings

Default

- see defaults on each property of DeviceTracking.

Inherited from

Omit.deviceTracking

domainPrefix?

optional domainPrefix?: string

Defined in: packages/constructs/src/auth/cognito.ts:117

Custom domain prefix override. Defaults to: {appName}-{stage}-{accountId}

email?

readonly optional email?: UserPoolEmail

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:748

Email settings for a user pool.

Default

- cognito will use the default email configuration

Inherited from

Omit.email

enableSmsRole?

readonly optional enableSmsRole?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:651

Setting this would explicitly enable or disable SMS role creation. When left unspecified, CDK will determine based on other properties if a role is needed or not.

Default

- CDK will determine based on other properties of the user pool if an SMS role should be created or not.

Inherited from

Omit.enableSmsRole

envConfig

envConfig: BaseEnvConfig

Defined in: packages/constructs/src/auth/cognito.ts:87

Axis env config — provides appName, stageName

extraCustomAttributes?

optional extraCustomAttributes?: Record<string, cognito.ICustomAttribute>

Defined in: packages/constructs/src/auth/cognito.ts:99

Extra custom attributes beyond the Axis defaults (custom:userId, custom:tenantId). Merged after Axis defaults.

featurePlan?

readonly optional featurePlan?: FeaturePlan

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:802

The user pool feature plan, or tier. This parameter determines the eligibility of the user pool for features like managed login, access-token customization, and threat protection.

See

https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html

Default

- FeaturePlan.ESSENTIALS for a newly created user pool; FeaturePlan.LITE otherwise

Inherited from

Omit.featurePlan

groups?

optional groups?: AxisGroupConfig[]

Defined in: packages/constructs/src/auth/cognito.ts:105

User pool groups to create. super-admin group is always created automatically.

keepOriginal?

readonly optional keepOriginal?: KeepOriginalAttrs

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:680

Attributes which Cognito will look to handle changes to the value of your users’ email address and phone number attributes. EMAIL and PHONE are the only available options.

Default

- Nothing is kept.

Inherited from

Omit.keepOriginal

logoutUrls?

optional logoutUrls?: string[]

Defined in: packages/constructs/src/auth/cognito.ts:111

OAuth logout URLs

mfa?

readonly optional mfa?: Mfa

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:701

Configure whether users of this user pool can or are required use MFA to sign in.

Default

Mfa.OFF

Inherited from

Omit.mfa

mfaMessage?

readonly optional mfaMessage?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:707

The SMS message template sent during MFA verification. Use ’{####}’ in the template where Cognito should insert the verification code.

Default

'Your authentication code is {####}.'

Inherited from

Omit.mfaMessage

mfaSecondFactor?

readonly optional mfaSecondFactor?: MfaSecondFactor

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:714

Configure the MFA types that users can use in this user pool. Ignored if mfa is set to OFF.

Default

{ sms: true, otp: false, email: false }, if mfa is set to OPTIONAL or REQUIRED. { sms: false, otp: false, email:false }, otherwise

Inherited from

Omit.mfaSecondFactor

passkeyRelyingPartyId?

readonly optional passkeyRelyingPartyId?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:735

The authentication domain that passkey providers must use as a relying party (RP) in their configuration.

Under the following conditions, the passkey relying party ID must be the fully-qualified domain name of your custom domain:

The user pool is configured for passkey authentication.
The user pool has a custom domain, whether or not it also has a prefix domain.
Your application performs authentication with managed login or the classic hosted UI.

Default

- No authentication domain

Inherited from

Omit.passkeyRelyingPartyId

passkeyUserVerification?

readonly optional passkeyUserVerification?: PasskeyUserVerification

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:743

Your user-pool treatment for MFA with a passkey. You can override other MFA options and require passkey MFA, or you can set it as preferred. When passkey MFA is preferred, the hosted UI encourages users to register a passkey at sign-in.

Default

- Cognito default setting is PasskeyUserVerification.PREFERRED

Inherited from

Omit.passkeyUserVerification

passwordPolicy?

readonly optional passwordPolicy?: PasswordPolicy

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:719

Password policy for this user pool.

Default

- see defaults on each property of PasswordPolicy.

Inherited from

Omit.passwordPolicy

selfSignUpEnabled?

readonly optional selfSignUpEnabled?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:608

Whether self sign-up should be enabled. To configure self sign-up configuration use the userVerification property.

Default

- false

Inherited from

Omit.selfSignUpEnabled

signInAliases?

readonly optional signInAliases?: SignInAliases

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:665

Methods in which a user registers or signs in to a user pool. Allows either username with aliases OR sign in with email, phone, or both.

Read the sections on usernames and aliases to learn more - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html

To match with ‘Option 1’ in the above link, with a verified email, this property should be set to { username: true, email: true }. To match with ‘Option 2’ in the above link with both a verified email and phone number, this property should be set to { email: true, phone: true }.

Default

{ username: true }

Inherited from

Omit.signInAliases

signInCaseSensitive?

readonly optional signInCaseSensitive?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:760

Whether sign-in aliases should be evaluated with case sensitivity. For example, when this option is set to false, users will be able to sign in using either MyUsername or myusername.

Default

true

Inherited from

Omit.signInCaseSensitive

signInPolicy?

readonly optional signInPolicy?: SignInPolicy

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:724

Sign-in policy for this user pool.

Default

- see defaults on each property of SignInPolicy.

Inherited from

Omit.signInPolicy

smsRole?

readonly optional smsRole?: IRoleRef

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:627

The IAM role that Cognito will assume while sending SMS messages.

Default

- a new IAM role is created.

Inherited from

Omit.smsRole

smsRoleExternalId?

readonly optional smsRoleExternalId?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:636

The ‘ExternalId’ that Cognito service must be using when assuming the smsRole, if the role is restricted with an ‘sts:ExternalId’ conditional. Learn more about ExternalId here - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html

This property will be ignored if smsRole is not specified.

Default

- No external id will be configured.

Inherited from

Omit.smsRoleExternalId

snsRegion?

readonly optional snsRegion?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:644

The region to integrate with SNS to send SMS messages.

This property will do nothing if SMS configuration is not configured.

Default

- The same region as the user pool, with a few exceptions - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html#user-pool-sms-settings-first-time

Inherited from

Omit.snsRegion

standardAttributes?

readonly optional standardAttributes?: StandardAttributes

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:687

The set of attributes that are required for every user in the user pool. Read more on attributes here - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html

Default

- All standard attributes are optional and mutable.

Inherited from

Omit.standardAttributes

standardThreatProtectionMode?

readonly optional standardThreatProtectionMode?: StandardThreatProtectionMode

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:814

The Type of Threat Protection Enabled for Standard Authentication

This feature only functions if your FeaturePlan is set to FeaturePlan.PLUS

See

https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html

Acceptable values are strings with values ‘ENFORCED’, ‘AUDIT’, or ‘OFF’

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-userpooladdons.html

Default

- StandardThreatProtectionMode.NO_ENFORCEMENT

Inherited from

Omit.standardThreatProtectionMode

triggers?

optional triggers?: AxisCognitoTriggers

Defined in: packages/constructs/src/auth/cognito.ts:93

Explicit trigger map — assign lambdas to Cognito trigger slots. Much safer than inferring trigger type from lambda name.

userInvitation?

readonly optional userInvitation?: UserInvitationConfig

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:621

Configuration around admins signing up users into a user pool.

Default

- see defaults in UserInvitationConfig.

Inherited from

Omit.userInvitation

userVerification?

readonly optional userVerification?: UserVerificationConfig

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:615

Configuration around users signing themselves up to the user pool. Enable or disable self sign-up via the selfSignUpEnabled property.

Default

- see defaults in UserVerificationConfig.

Inherited from

Omit.userVerification