Skip to content

Commit 37c579d

Browse files
ramesh-maddegodaramesh-maddegoda
committed
UPDATE to use shared Cognito user pool and create DUM-specific app client
- Removed creation and management of Cognito user pool, domain, users, and groups from DUM - Switched to using shared PDS Cognito user pool via SSM parameter - Added DUM-specific Cognito app client (pds-dum-auth-client) - Stored app client ID in SSM parameter (/pds/dum/cognito-auth-client-id) - Updated Lambda authorizer to use shared user pool and DUM client ID - Removed obsolete outputs and variables related to user pool and users - Ensured no modifications to shared Cognito resources This change decouples DUM from Cognito user lifecycle management and aligns with shared infrastructure ownership model. Related issue: #348
1 parent 2e9bedc commit 37c579d

7 files changed

Lines changed: 172 additions & 301 deletions

File tree

‎terraform/main.tf‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,10 @@ resource "aws_lambda_event_source_mapping" "lambda_status_service_sqs_trigger" {
5959
module "nucleus_dum_cognito" {
6060
source = "./modules/cognito"
6161

62-
nucleus_dum_cognito_initial_users = var.nucleus_dum_cognito_initial_users
62+
pds_common_cognito_user_pool_id_ssm_parameter_name = var.pds_common_cognito_user_pool_id_ssm_parameter_name
63+
dum_cognito_auth_client_id_ssm_parameter_name = var.dum_cognito_auth_client_id_ssm_parameter_name
64+
cognito_user_pool_client_name = var.cognito_user_pool_client_name
65+
6366
tags = {
6467
tenant = var.tag_tenant
6568
venue = var.tag_venue
@@ -74,9 +77,10 @@ module "nucleus_dum_lambda_authorizer" {
7477

7578
lambda_s3_bucket_name = var.lambda_s3_bucket_name
7679
lambda_authorizer_iam_role_arn = var.lambda_authorizer_iam_role_arn
77-
lambda_authorizer_cognito_pool_id = module.nucleus_dum_cognito.nucleus_dum_cognito_user_pool_id
78-
lambda_authorizer_cognito_client_id = module.nucleus_dum_cognito.nucleus_dum_cognito_user_pool_client_id
80+
lambda_authorizer_cognito_pool_id = module.nucleus_dum_cognito.pds_common_cognito_user_pool_id
81+
lambda_authorizer_cognito_client_id = module.nucleus_dum_cognito.dum_cognito_auth_client_id
7982
lambda_authorizer_localstack_context = var.localstack_context
83+
8084
tags = {
8185
tenant = var.tag_tenant
8286
venue = var.tag_venue

‎terraform/modules/cognito/cognito_pool.tf‎

Lines changed: 42 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -1,120 +1,62 @@
1-
# Terraform module for the Data Upload Manager (DUM) Cognito User Pool
1+
# DUM Cognito Client Setup Using Shared Cognito Infrastructure
2+
#
3+
# NOTE:
4+
# This module uses a PDS common Cognito user pool managed by a separate
5+
# Terraform stack and does NOT create or manage the user pool, domain,
6+
# users, or groups.
7+
#
8+
# It reads the existing user pool ID from SSM Parameter Store and creates
9+
# only a DUM-specific Cognito app client. The client ID is stored in a
10+
# DUM-specific SSM parameter for use by downstream services such as the
11+
# Lambda authorizer.
12+
#
13+
# This ensures clear separation of ownership:
14+
# - Shared infrastructure manages the user pool and user lifecycle
15+
# - DUM manages only its own authentication client configuration
16+
#
17+
# IMPORTANT:
18+
# This module must not modify or impact the shared user pool or any
19+
# existing users/groups within it.
20+
21+
data "aws_ssm_parameter" "pds_common_cognito_user_pool_id" {
22+
name = var.pds_common_cognito_user_pool_id_ssm_parameter_name
23+
}
24+
25+
resource "aws_cognito_user_pool_client" "dum_auth_client" {
26+
name = var.cognito_user_pool_client_name
27+
user_pool_id = data.aws_ssm_parameter.pds_common_cognito_user_pool_id.value
228

3-
resource "aws_cognito_user_pool" "nucleus_dum_cognito_user_pool" {
4-
name = var.user_pool_name
5-
6-
tags = var.tags
7-
8-
admin_create_user_config {
9-
invite_message_template {
10-
email_subject = var.email_invitation_subject
11-
email_message = var.email_invitation_message
12-
sms_message = var.sms_text_invitation_message
13-
}
14-
15-
allow_admin_create_user_only = true
16-
}
17-
18-
account_recovery_setting {
19-
recovery_mechanism {
20-
name = "verified_email"
21-
priority = 1
22-
}
23-
}
24-
25-
auto_verified_attributes = ["email"]
26-
27-
user_attribute_update_settings {
28-
attributes_require_verification_before_update = ["email"]
29-
}
30-
31-
username_configuration {
32-
case_sensitive = false
33-
}
34-
35-
password_policy {
36-
minimum_length = 8
37-
require_lowercase = true
38-
require_uppercase = true
39-
require_numbers = true
40-
require_symbols = true
41-
}
42-
}
43-
44-
resource "aws_ssm_parameter" "nucleus_dum_cognito_user_pool_id_parameter" {
45-
name = format(var.ssm_param_cognito_user_pool_id)
46-
type = "String"
47-
value = aws_cognito_user_pool.nucleus_dum_cognito_user_pool.id
48-
depends_on = [aws_cognito_user_pool.nucleus_dum_cognito_user_pool]
49-
50-
tags = var.tags
51-
}
52-
53-
resource "aws_cognito_user_pool_client" "nucleus_dum_cognito_user_pool_client" {
54-
name = "nucleus-dum-cognito-user-pool-client"
55-
user_pool_id = aws_ssm_parameter.nucleus_dum_cognito_user_pool_id_parameter.value
5629
generate_secret = false
5730
prevent_user_existence_errors = "ENABLED"
58-
callback_urls = ["http://localhost:3000"]
31+
callback_urls = var.callback_urls
5932
allowed_oauth_flows_user_pool_client = true
6033
allowed_oauth_flows = ["code"]
6134
allowed_oauth_scopes = ["email", "openid"]
62-
explicit_auth_flows = ["ALLOW_CUSTOM_AUTH", "ALLOW_REFRESH_TOKEN_AUTH", "ALLOW_USER_PASSWORD_AUTH", "ALLOW_USER_SRP_AUTH"]
63-
supported_identity_providers = ["COGNITO"]
35+
36+
explicit_auth_flows = [
37+
"ALLOW_CUSTOM_AUTH",
38+
"ALLOW_REFRESH_TOKEN_AUTH",
39+
"ALLOW_USER_PASSWORD_AUTH",
40+
"ALLOW_USER_SRP_AUTH"
41+
]
42+
43+
supported_identity_providers = ["COGNITO"]
6444

6545
refresh_token_validity = 30
6646
access_token_validity = 60
6747
id_token_validity = 60
48+
6849
token_validity_units {
6950
refresh_token = "days"
7051
access_token = "minutes"
7152
id_token = "minutes"
7253
}
7354
}
7455

75-
resource "aws_ssm_parameter" "nucleus_dum_cognito_user_pool_client_id_parameter" {
76-
name = format(var.ssm_param_cognito_user_pool_client_id)
77-
type = "String"
78-
value = aws_cognito_user_pool_client.nucleus_dum_cognito_user_pool_client.id
79-
depends_on = [aws_cognito_user_pool_client.nucleus_dum_cognito_user_pool_client]
56+
resource "aws_ssm_parameter" "dum_cognito_auth_client_id_parameter" {
57+
name = var.dum_cognito_auth_client_id_ssm_parameter_name
58+
type = "String"
59+
value = aws_cognito_user_pool_client.dum_auth_client.id
8060

8161
tags = var.tags
8262
}
83-
84-
resource "aws_cognito_user_pool_domain" "nucleus_dum_cognito_user_pool_domain" {
85-
domain = var.user_pool_domain
86-
user_pool_id = aws_ssm_parameter.nucleus_dum_cognito_user_pool_id_parameter.value
87-
}
88-
89-
resource "aws_cognito_user_group" "nucleus_dum_cognito_user_groups" {
90-
count = length(var.nucleus_dum_cognito_user_groups)
91-
92-
name = var.nucleus_dum_cognito_user_groups[count.index].name
93-
description = var.nucleus_dum_cognito_user_groups[count.index].description
94-
user_pool_id = aws_ssm_parameter.nucleus_dum_cognito_user_pool_id_parameter.value
95-
}
96-
97-
resource "aws_cognito_user" "nucleus_dum_cognito_initial_users" {
98-
count = length(var.nucleus_dum_cognito_initial_users)
99-
100-
username = var.nucleus_dum_cognito_initial_users[count.index].username
101-
user_pool_id = aws_ssm_parameter.nucleus_dum_cognito_user_pool_id_parameter.value
102-
desired_delivery_mediums = ["EMAIL"]
103-
enabled = true
104-
message_action = "SUPPRESS"
105-
password = var.nucleus_dum_cognito_initial_users[count.index].password
106-
107-
attributes = {
108-
email = var.nucleus_dum_cognito_initial_users[count.index].email
109-
email_verified = true
110-
}
111-
}
112-
113-
resource "aws_cognito_user_in_group" "nucleus_dum_cognito_initial_user_group_assignment" {
114-
count = length(var.nucleus_dum_cognito_initial_users)
115-
depends_on = [aws_cognito_user.nucleus_dum_cognito_initial_users]
116-
117-
username = var.nucleus_dum_cognito_initial_users[count.index].username
118-
group_name = var.nucleus_dum_cognito_initial_users[count.index].group
119-
user_pool_id = aws_ssm_parameter.nucleus_dum_cognito_user_pool_id_parameter.value
120-
}

‎terraform/modules/cognito/outputs.tf‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
1+
# Outputs for DUM Cognito Client Setup Using Shared Cognito Infrastructure
12

2-
output "nucleus_dum_cognito_user_pool_id" {
3-
value = aws_ssm_parameter.nucleus_dum_cognito_user_pool_id_parameter.value
3+
output "pds_common_cognito_user_pool_id" {
4+
description = "Shared PDS Cognito User Pool ID used by DUM"
5+
value = data.aws_ssm_parameter.pds_common_cognito_user_pool_id.value
46
}
57

6-
output "nucleus_dum_cognito_user_pool_client_id" {
7-
value = aws_ssm_parameter.nucleus_dum_cognito_user_pool_client_id_parameter.value
8-
}
9-
10-
output "nucleus_dum_cognito_users" {
11-
value = [var.nucleus_dum_cognito_initial_users.*.username]
8+
output "dum_cognito_auth_client_id" {
9+
description = "DUM Cognito app client ID"
10+
value = aws_cognito_user_pool_client.dum_auth_client.id
1211
}

‎terraform/modules/cognito/variables.tf‎

Lines changed: 14 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,109 +1,27 @@
1+
# Variables for DUM Cognito Client Setup Using Shared Cognito Infrastructure
12

2-
variable "user_pool_name" {
3+
variable "pds_common_cognito_user_pool_id_ssm_parameter_name" {
34
type = string
4-
description = "Name of the Cognito User Pool"
5-
default = "nucleus-dum-cognito-user-pool"
5+
description = "SSM parameter name that stores the shared PDS Cognito User Pool ID"
6+
default = "/pds/cds-infra/cognito/user-pool/user-pool-id"
67
}
78

8-
variable "user_pool_domain" {
9+
variable "dum_cognito_auth_client_id_ssm_parameter_name" {
910
type = string
10-
description = "Unique domain name for the DUM Cognito Pool"
11-
default = "pds-nucleus-dum"
11+
description = "SSM parameter name used by DUM to store its Cognito app client ID"
12+
default = "/pds/dum/cognito-auth-client-id"
1213
}
1314

14-
variable "email_invitation_subject" {
15+
variable "cognito_user_pool_client_name" {
1516
type = string
16-
description = "Subject line for use with invitation emails"
17-
default = "PDS Data Upload Manager Temporary Credentials"
17+
description = "Name of the DUM Cognito app client"
18+
default = "pds-dum-auth-client"
1819
}
1920

20-
variable "email_invitation_message" {
21-
type = string
22-
description = "Message body for use with invitation emails"
23-
default = "Your PDS Data Upload Manager username is {username} and temporary password is {####}. You must change this password the next time you log in."
24-
}
25-
26-
variable "sms_text_invitation_message" {
27-
type = string
28-
description = "Message body for use with SMS text invitations"
29-
default = "Your username is {username} and temporary password is {####}"
30-
}
31-
32-
variable "ssm_param_cognito_user_pool_id" {
33-
type = string
34-
description = "SSM Parameter location for securely storing the Cognito User Pool ID"
35-
default = "/pds/dum/cognito/cognito-user-pool/user-pool-id"
36-
}
37-
38-
variable "ssm_param_cognito_user_pool_client_id" {
39-
type = string
40-
description = "SSM Parameter location for securely storing the Cognito User Pool Client ID"
41-
default = "/pds/dum/cognito/cognito-user-pool/user-pool-client-id"
42-
}
43-
44-
variable "nucleus_dum_cognito_user_groups" {
45-
description = "List of the PDS DUM Cognito User Groups"
46-
type = list(
47-
object(
48-
{
49-
name = string
50-
description = string
51-
}
52-
)
53-
)
54-
default = [
55-
{
56-
name = "PDS_ATM_USERS",
57-
description = "User group for PDS Atmospheres Node"
58-
},
59-
{
60-
name = "PDS_ENG_USERS"
61-
description = "User group for PDS Engineering Node"
62-
},
63-
{
64-
name = "PDS_GEO_USERS"
65-
description = "User group for PDS Geosciences Node"
66-
},
67-
{
68-
name = "PDS_IMG_USERS"
69-
description = "User group for PDS Cartography and Imaging Sciences Discipline Node"
70-
},
71-
{
72-
name = "PDS_NAIF_USERS"
73-
description = "User group for PDS Navigational and Ancillary Information Facility Node"
74-
},
75-
{
76-
name = "PDS_PPI_USERS"
77-
description = "User group for PDS Planetary Plasma Interactions Node"
78-
},
79-
{
80-
name = "PDS_RS_USERS"
81-
description = "User group for PDS Radio Science Node"
82-
},
83-
{
84-
name = "PDS_RMS_USERS",
85-
description = "User group for PDS Ring-Moon Systems Node"
86-
},
87-
{
88-
name = "PDS_SBN_USERS",
89-
description = "User group for PDS Small Bodies Node"
90-
}
91-
]
92-
}
93-
94-
variable "nucleus_dum_cognito_initial_users" {
95-
description = "Optional list of users and group to pre-populate the User Pool with"
96-
type = list(
97-
object(
98-
{
99-
username = string
100-
password = string
101-
group = string
102-
email = string
103-
}
104-
)
105-
)
106-
default = []
21+
variable "callback_urls" {
22+
type = list(string)
23+
description = "Callback URLs for the DUM Cognito app client"
24+
default = ["http://localhost:3000"]
10725
}
10826

10927
variable "tags" {

0 commit comments

Comments
 (0)