Adding AWS Cognito User Pool role using CDK

Question

I have deployed https://github.com/aws-samples/amazon-elasticsearch-service-with-cognito to my stack, and am trying to add a master group as per https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html#fgac-walkthrough-iam

So I have added to the following https://github.com/aws-samples/amazon-elasticsearch-service-with-cognito/blob/master/lib/search-stack.ts#L50

diff --git a/lib/search-stack.ts b/lib/search-stack.ts
index 85de0c0..2493c92 100644
--- a/lib/search-stack.ts
+++ b/lib/search-stack.ts
@@ -3,7 +3,7 @@

 import { Fn, Stack, Construct, StackProps, CfnParameter, CfnOutput } from '@aws-cdk/core';
 import { CfnDomain } from '@aws-cdk/aws-elasticsearch';
-import { UserPoolAttribute, CfnUserPoolDomain, CfnIdentityPool, CfnIdentityPoolRoleAttachment, CfnUserPool } from '@aws-cdk/aws-cognito';
+import { UserPoolAttribute, CfnUserPoolDomain, CfnIdentityPool, CfnIdentityPoolRoleAttachment, CfnUserPool, CfnUserPoolGroup } from '@aws-cdk/aws-cognito';
 import { Role, ManagedPolicy, ServicePrincipal, FederatedPrincipal } from '@aws-cdk/aws-iam';
 import { CustomResource } from '@aws-cdk/aws-cloudformation';

@@ -55,6 +55,19 @@ export class SearchStack extends Stack {
       }, "sts:AssumeRoleWithWebIdentity")
     });

+    // create two groups, one for admins one for users
+
+    new CfnUserPoolGroup(this, "AdminsGroup", {
+      groupName: "master-user-group",
+      userPoolId: idPool.ref,
+
+    });
+
+    new CfnUserPoolGroup(this, "UsersGroup", {
+      groupName: "limited-user-group",
+      userPoolId: idPool.ref,
+    });
+
     const esRole = new Role(this, "esRole", {
       assumedBy: new ServicePrincipal('es.amazonaws.com'),
       managedPolicies: [ManagedPolicy.fromAwsManagedPolicyName("AmazonESCognitoAccess")]
~

but after redeploying the roles are not being created!

any advice is much appreciated.

Arian Acosta · Accepted Answer · 2021-02-24 02:58:27Z

7

As of AWS CDK v1.91.0 the use the userPoolId instead of ref:

import * as cognito from '@aws-cdk/aws-cognito';

//...

const userPool = new cognito.UserPool(this, 'UserPool', {
  //...
});

new cognito.CfnUserPoolGroup(this, "ManagerGroup", {
  groupName: "manager",
  userPoolId: userPool.userPoolId
});

answered Feb 24, 2021 at 2:58

Arian Acosta

6,8551 gold badge38 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

khinester · Accepted Answer · 2020-06-01 23:29:06Z

6

OK, I needed to use:


    new CfnUserPoolGroup(this, "AdminsGroup", {
      groupName: "master-user-group",
      userPoolId: userPool.ref
    });

    new CfnUserPoolGroup(this, "UsersGroup", {
      groupName: "limited-user-group",
      userPoolId: userPool.ref
    });

instead of idPool.ref

answered Jun 1, 2020 at 23:29

khinester

3,5229 gold badges52 silver badges92 bronze badges

1 Comment

dmahapatro Over a year ago

You beat me to it. Yesterday I saw that but I got side tracked and totally missed answering it. Thankfully you got it all sorted out !!

steffeng · Accepted Answer · 2020-12-02 21:35:37Z

1

Starting with version 1.1.1 the amazon-elasticsearch-service-with-cognito code includes the configuration for fine-grained access control, including an Amazon Cognito group called "es-admins", and the required role resolution.

answered Dec 2, 2020 at 21:35

steffeng

485 bronze badges

Collectives™ on Stack Overflow

Adding AWS Cognito User Pool role using CDK

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related