CognitoStackProps

Open in ChatGPT Open in Claude

Defined in: packages/stacks/src/cognito-stack.ts:39

Extends

BaseStackProps<T>.Omit<AtfCognitoProps, "envConfig" | "triggers" | "groups">

Type Parameters

T

T extends BaseEnvConfig

Properties

accountRecovery?

readonly optional accountRecovery?: AccountRecovery

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:766

How will a user be able to recover their account?

Default

AccountRecovery.PHONE_WITHOUT_MFA_AND_EMAIL

Inherited from

Omit.accountRecovery

advancedSecurityMode?

readonly optional advancedSecurityMode?: AdvancedSecurityMode

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:795

The user pool’s Advanced Security Mode

Default

- no value

Inherited from

Omit.advancedSecurityMode

analyticsReporting?

readonly optional analyticsReporting?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:141

Include runtime versioning information in this Stack

Default

analyticsReporting setting of containing App, or value of ‘aws:cdk:version-reporting’ context key

Inherited from

BaseStackProps.analyticsReporting

autoVerify?

readonly optional autoVerify?: AutoVerifiedAttrs

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:673

Attributes which Cognito will look to verify automatically upon user sign up. EMAIL and PHONE are the only available options.

Default

If signInAlias includes email and/or phone, they will be included in autoVerifiedAttributes by default. If absent, no attributes will be auto-verified.

Inherited from

Omit.autoVerify

callbackUrls?

optional callbackUrls?: string[]

Defined in: packages/constructs/src/auth/cognito.ts:108

OAuth callback URLs for hosted UI

Inherited from

AtfCognitoProps.callbackUrls

crossRegionReferences?

readonly optional crossRegionReferences?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:152

Enable this flag to allow native cross region stack references.

Enabling this will create a CloudFormation custom resource in both the producing stack and consuming stack in order to perform the export/import

This feature is currently experimental

Default

false

Inherited from

BaseStackProps.crossRegionReferences

customSenderKmsKey?

readonly optional customSenderKmsKey?: IKeyRef

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:789

This key will be used to encrypt temporary passwords and authorization codes that Amazon Cognito generates.

See

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-sender-triggers.html

Default

- no key ID configured

Inherited from

Omit.customSenderKmsKey

customThreatProtectionMode?

readonly optional customThreatProtectionMode?: CustomThreatProtectionMode

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:826

The Type of Threat Protection Enabled for Custom Authentication

This feature only functions if your FeaturePlan is set to FeaturePlan.PLUS

See

https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html

Acceptable values are strings with values ‘ENFORCED’, or ‘AUDIT’. For ‘OFF’ behavior, don’t define this value

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-userpooladdons.html

Default

- no value

Inherited from

Omit.customThreatProtectionMode

deletionProtection?

readonly optional deletionProtection?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:778

Indicates whether the user pool should have deletion protection enabled.

Default

false

Inherited from

Omit.deletionProtection

description?

readonly optional description?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:19

A description of the stack.

Default

- No description.

Inherited from

BaseStackProps.description

deviceTracking?

readonly optional deviceTracking?: DeviceTracking

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:783

Device tracking settings

Default

- see defaults on each property of DeviceTracking.

Inherited from

Omit.deviceTracking

domainPrefix?

optional domainPrefix?: string

Defined in: packages/constructs/src/auth/cognito.ts:117

Custom domain prefix override. Defaults to: {appName}-{stage}-{accountId}

Inherited from

AtfCognitoProps.domainPrefix

email?

readonly optional email?: UserPoolEmail

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:748

Email settings for a user pool.

Default

- cognito will use the default email configuration

Inherited from

Omit.email

enableSmsRole?

readonly optional enableSmsRole?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:651

Setting this would explicitly enable or disable SMS role creation. When left unspecified, CDK will determine based on other properties if a role is needed or not.

Default

- CDK will determine based on other properties of the user pool if an SMS role should be created or not.

Inherited from

Omit.enableSmsRole

env?

readonly optional env?: Environment

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:84

The AWS environment (account/region) where this stack will be deployed.

Set the region/account fields of env to either a concrete value to select the indicated environment (recommended for production stacks), or to the values of environment variables CDK_DEFAULT_REGION/CDK_DEFAULT_ACCOUNT to let the target environment depend on the AWS credentials/configuration that the CDK CLI is executed under (recommended for development stacks).

If the Stack is instantiated inside a Stage, any undefined region/account fields from env will default to the same field on the encompassing Stage, if configured there.

If either region or account are not set nor inherited from Stage, the Stack will be considered “environment-agnostic"". Environment-agnostic stacks can be deployed to any environment but may not be able to take advantage of all features of the CDK. For example, they will not be able to use environmental context lookups such as ec2.Vpc.fromLookup and will not automatically translate Service Principals to the right format based on the environment’s AWS partition, and other such enhancements.

Example

// Use a concrete account and region to deploy this stack to:
// `.account` and `.region` will simply return these values.
new Stack(app, 'Stack1', {
  env: {
    account: '123456789012',
    region: 'us-east-1'
  },
});

// Use the CLI's current credentials to determine the target environment:
// `.account` and `.region` will reflect the account+region the CLI
// is configured to use (based on the user CLI credentials)
new Stack(app, 'Stack2', {
  env: {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: process.env.CDK_DEFAULT_REGION
  },
});

// Define multiple stacks stage associated with an environment
const myStage = new Stage(app, 'MyStage', {
  env: {
    account: '123456789012',
    region: 'us-east-1'
  }
});

// both of these stacks will use the stage's account/region:
// `.account` and `.region` will resolve to the concrete values as above
new MyStack(myStage, 'Stack1');
new YourStack(myStage, 'Stack2');

// Define an environment-agnostic stack:
// `.account` and `.region` will resolve to `{ "Ref": "AWS::AccountId" }` and `{ "Ref": "AWS::Region" }` respectively.
// which will only resolve to actual values by CloudFormation during deployment.
new MyStack(app, 'Stack1');

Default

The environment of the containing Stage if available, otherwise create the stack will be environment-agnostic.

Inherited from

BaseStackProps.env

envConfig

envConfig: T

Defined in: packages/stacks/src/base-stack.ts:15

Inherited from

BaseStackProps.envConfig

extraCustomAttributes?

optional extraCustomAttributes?: Record<string, cognito.ICustomAttribute>

Defined in: packages/constructs/src/auth/cognito.ts:99

Extra custom attributes beyond the Axis defaults (custom:userId, custom:tenantId). Merged after Axis defaults.

Inherited from

AtfCognitoProps.extraCustomAttributes

extraGroups?

optional extraGroups?: AxisGroupConfig[]

Defined in: packages/stacks/src/cognito-stack.ts:60

User pool groups to create (super-admin is always created)

featurePlan?

readonly optional featurePlan?: FeaturePlan

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:802

The user pool feature plan, or tier. This parameter determines the eligibility of the user pool for features like managed login, access-token customization, and threat protection.

See

https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html

Default

- FeaturePlan.ESSENTIALS for a newly created user pool; FeaturePlan.LITE otherwise

Inherited from

Omit.featurePlan

keepOriginal?

readonly optional keepOriginal?: KeepOriginalAttrs

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:680

Attributes which Cognito will look to handle changes to the value of your users’ email address and phone number attributes. EMAIL and PHONE are the only available options.

Default

- Nothing is kept.

Inherited from

Omit.keepOriginal

logoutUrls?

optional logoutUrls?: string[]

Defined in: packages/constructs/src/auth/cognito.ts:111

OAuth logout URLs

Inherited from

AtfCognitoProps.logoutUrls

mfa?

readonly optional mfa?: Mfa

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:701

Configure whether users of this user pool can or are required use MFA to sign in.

Default

Mfa.OFF

Inherited from

Omit.mfa

mfaMessage?

readonly optional mfaMessage?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:707

The SMS message template sent during MFA verification. Use ’{####}’ in the template where Cognito should insert the verification code.

Default

'Your authentication code is {####}.'

Inherited from

Omit.mfaMessage

mfaSecondFactor?

readonly optional mfaSecondFactor?: MfaSecondFactor

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:714

Configure the MFA types that users can use in this user pool. Ignored if mfa is set to OFF.

Default

{ sms: true, otp: false, email: false }, if mfa is set to OPTIONAL or REQUIRED. { sms: false, otp: false, email:false }, otherwise

Inherited from

Omit.mfaSecondFactor

notificationArns?

readonly optional notificationArns?: string[]

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:112

SNS Topic ARNs that will receive stack events.

Default

- no notification arns.

Inherited from

BaseStackProps.notificationArns

passkeyRelyingPartyId?

readonly optional passkeyRelyingPartyId?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:735

The authentication domain that passkey providers must use as a relying party (RP) in their configuration.

Under the following conditions, the passkey relying party ID must be the fully-qualified domain name of your custom domain:

The user pool is configured for passkey authentication.
The user pool has a custom domain, whether or not it also has a prefix domain.
Your application performs authentication with managed login or the classic hosted UI.

Default

- No authentication domain

Inherited from

Omit.passkeyRelyingPartyId

passkeyUserVerification?

readonly optional passkeyUserVerification?: PasskeyUserVerification

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:743

Your user-pool treatment for MFA with a passkey. You can override other MFA options and require passkey MFA, or you can set it as preferred. When passkey MFA is preferred, the hosted UI encourages users to register a passkey at sign-in.

Default

- Cognito default setting is PasskeyUserVerification.PREFERRED

Inherited from

Omit.passkeyUserVerification

passwordPolicy?

readonly optional passwordPolicy?: PasswordPolicy

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:719

Password policy for this user pool.

Default

- see defaults on each property of PasswordPolicy.

Inherited from

Omit.passwordPolicy

permissionsBoundary?

readonly optional permissionsBoundary?: PermissionsBoundary

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:159

Options for applying a permissions boundary to all IAM Roles and Users created within this Stage

Default

- no permissions boundary is applied

Inherited from

BaseStackProps.permissionsBoundary

projectRoot

projectRoot: string

Defined in: packages/stacks/src/cognito-stack.ts:63

Project root for Lambda entry path resolution

propertyInjectors?

readonly optional propertyInjectors?: IPropertyInjector[]

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:175

A list of IPropertyInjector attached to this Stack.

Default

- no PropertyInjectors

Inherited from

BaseStackProps.propertyInjectors

selfSignUpEnabled?

readonly optional selfSignUpEnabled?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:608

Whether self sign-up should be enabled. To configure self sign-up configuration use the userVerification property.

Default

- false

Inherited from

Omit.selfSignUpEnabled

signInAliases?

readonly optional signInAliases?: SignInAliases

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:665

Methods in which a user registers or signs in to a user pool. Allows either username with aliases OR sign in with email, phone, or both.

Read the sections on usernames and aliases to learn more - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html

To match with ‘Option 1’ in the above link, with a verified email, this property should be set to { username: true, email: true }. To match with ‘Option 2’ in the above link with both a verified email and phone number, this property should be set to { email: true, phone: true }.

Default

{ username: true }

Inherited from

Omit.signInAliases

signInCaseSensitive?

readonly optional signInCaseSensitive?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:760

Whether sign-in aliases should be evaluated with case sensitivity. For example, when this option is set to false, users will be able to sign in using either MyUsername or myusername.

Default

true

Inherited from

Omit.signInCaseSensitive

signInPolicy?

readonly optional signInPolicy?: SignInPolicy

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:724

Sign-in policy for this user pool.

Default

- see defaults on each property of SignInPolicy.

Inherited from

Omit.signInPolicy

smsRole?

readonly optional smsRole?: IRoleRef

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:627

The IAM role that Cognito will assume while sending SMS messages.

Default

- a new IAM role is created.

Inherited from

Omit.smsRole

smsRoleExternalId?

readonly optional smsRoleExternalId?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:636

The ‘ExternalId’ that Cognito service must be using when assuming the smsRole, if the role is restricted with an ‘sts:ExternalId’ conditional. Learn more about ExternalId here - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html

This property will be ignored if smsRole is not specified.

Default

- No external id will be configured.

Inherited from

Omit.smsRoleExternalId

snsRegion?

readonly optional snsRegion?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:644

The region to integrate with SNS to send SMS messages.

This property will do nothing if SMS configuration is not configured.

Default

- The same region as the user pool, with a few exceptions - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html#user-pool-sms-settings-first-time

Inherited from

Omit.snsRegion

stackName?

readonly optional stackName?: string

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:90

Name to deploy the stack with

Default

- Derived from construct path.

Inherited from

BaseStackProps.stackName

standardAttributes?

readonly optional standardAttributes?: StandardAttributes

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:687

The set of attributes that are required for every user in the user pool. Read more on attributes here - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html

Default

- All standard attributes are optional and mutable.

Inherited from

Omit.standardAttributes

standardThreatProtectionMode?

readonly optional standardThreatProtectionMode?: StandardThreatProtectionMode

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:814

The Type of Threat Protection Enabled for Standard Authentication

This feature only functions if your FeaturePlan is set to FeaturePlan.PLUS

See

https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html

Acceptable values are strings with values ‘ENFORCED’, ‘AUDIT’, or ‘OFF’

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-userpooladdons.html

Default

- StandardThreatProtectionMode.NO_ENFORCEMENT

Inherited from

Omit.standardThreatProtectionMode

suppressTemplateIndentation?

readonly optional suppressTemplateIndentation?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:170

Enable this flag to suppress indentation in generated CloudFormation templates.

If not specified, the value of the @aws-cdk/core:suppressTemplateIndentation context key will be used. If that is not specified, then the default value false will be used.

Default

the value of @aws-cdk/core:suppressTemplateIndentation, or false if that is not set.

Inherited from

BaseStackProps.suppressTemplateIndentation

synthesizer?

readonly optional synthesizer?: IStackSynthesizer

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:128

Synthesis method to use while deploying this stack

The Stack Synthesizer controls aspects of synthesis and deployment, like how assets are referenced and what IAM roles to use. For more information, see the README of the main CDK package.

If not specified, the defaultStackSynthesizer from App will be used. If that is not specified, DefaultStackSynthesizer is used if @aws-cdk/core:newStyleStackSynthesis is set to true or the CDK major version is v2. In CDK v1 LegacyStackSynthesizer is the default if no other synthesizer is specified.

Default

The synthesizer specified on App, or DefaultStackSynthesizer otherwise.

Inherited from

BaseStackProps.synthesizer

tags?

readonly optional tags?: object

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:104

Tags that will be applied to the Stack

These tags are applied to the CloudFormation Stack itself. They will not appear in the CloudFormation template.

However, at deployment time, CloudFormation will apply these tags to all resources in the stack that support tagging. You will not be able to exempt resources from tagging (using the excludeResourceTypes property of Tags.of(...).add()) for tags applied in this way.

Index Signature

[key: string]: string

Default

{}

Inherited from

BaseStackProps.tags

terminationProtection?

readonly optional terminationProtection?: boolean

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/core/lib/stack.d.ts:134

Whether to enable termination protection for this stack.

Default

false

Inherited from

BaseStackProps.terminationProtection

triggerConfigs?

optional triggerConfigs?: CognitoTriggerConfig[]

Defined in: packages/stacks/src/cognito-stack.ts:57

Explicit trigger configs — each entry maps a lambda to a trigger slot.

Example: triggerConfigs: [ { triggerType: “postConfirmation”, config: postConfirmConfig }, { triggerType: “preSignUp”, config: preSignUpConfig }, ]

userInvitation?

readonly optional userInvitation?: UserInvitationConfig

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:621

Configuration around admins signing up users into a user pool.

Default

- see defaults in UserInvitationConfig.

Inherited from

Omit.userInvitation

userVerification?

readonly optional userVerification?: UserVerificationConfig

Defined in: node_modules/.pnpm/aws-cdk-lib@2.261.0_constructs@10.7.0/node_modules/aws-cdk-lib/aws-cognito/lib/user-pool.d.ts:615

Configuration around users signing themselves up to the user pool. Enable or disable self sign-up via the selfSignUpEnabled property.

Default

- see defaults in UserVerificationConfig.

Inherited from

Omit.userVerification