-
Notifications
You must be signed in to change notification settings - Fork 1
/
variables.tf
455 lines (377 loc) · 14.9 KB
/
variables.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
#Module : LABEL
#Description : Terraform label module variables.
variable "name" {
type = string
default = ""
description = "Name (e.g. `app` or `cluster`)."
}
variable "environment" {
type = string
default = ""
description = "Environment (e.g. `prod`, `dev`, `staging`)."
}
variable "repository" {
type = string
default = "https://github.com/clouddrove/terraform-aws-cognito"
description = "Terraform current module repo"
}
variable "label_order" {
type = list(any)
default = []
description = "Label order, e.g. `name`,`application`."
}
variable "managedby" {
type = string
default = "hello@clouddrove.com"
description = "ManagedBy, eg 'CloudDrove'"
}
variable "enabled" {
type = bool
default = true
description = "Flag to control the cognito creation."
}
#Module : User Pool
#Description :
variable "alias_attributes" {
type = list(any)
default = []
description = "Attributes supported as an alias for this user pool. Valid values: phone_number, email, or preferred_username. Conflicts with username_attributes."
}
variable "auto_verified_attributes" {
type = list(any)
default = ["email"]
description = "Attributes to be auto-verified. Valid values: email, phone_number."
}
variable "username_attributes" {
type = list(any)
default = ["email"]
description = "Whether email addresses or phone numbers can be specified as usernames when a user signs up. Conflicts with alias_attributes."
}
variable "mfa_configuration" {
type = string
default = "OFF"
description = "Multi-Factor Authentication (MFA) configuration for the User Pool. Defaults of OFF. Valid values are OFF, ON and OPTIONAL."
}
variable "allow_software_mfa_token" {
description = "(Optional) Boolean whether to enable software token Multi-Factor (MFA) tokens, such as Time-based One-Time Password (TOTP). To disable software token MFA when 'sms_configuration' is not present, the 'mfa_configuration' argument must be set to OFF and the 'software_token_mfa_configuration' configuration block must be fully removed."
type = bool
default = true
}
variable "advanced_security_mode" {
type = string
default = "OFF"
description = "Mode for advanced security, must be one of OFF, AUDIT or ENFORCED."
}
variable "sms_authentication_message" {
type = string
default = "Your username is {username}. Sign up at {####}"
description = "String representing the SMS authentication message. The Message must contain the {####} placeholder, which will be replaced with the code."
}
variable "case_sensitive" {
type = bool
default = true
description = "Whether username case sensitivity will be applied for all users in the user pool through Cognito APIs."
}
variable "email_message" {
type = string
default = ""
}
################################################
## Admin Create USer
################################################
variable "minimum_length" {
type = number
description = "(Optional) The minimum length of the password policy that you have set."
default = 12
}
variable "require_lowercase" {
type = bool
description = "(Optional) Whether you have required users to use at least one lowercase letter in their password."
default = true
}
variable "require_numbers" {
type = bool
default = true
description = "Whether you have required users to use at least one number in their password."
}
variable "require_symbols" {
type = bool
default = true
description = "Whether you have required users to use at least one symbol in their password."
}
variable "require_uppercase" {
type = bool
default = true
description = "Whether you have required users to use at least one uppercase letter in their password."
}
variable "temporary_password_validity_days" {
type = number
description = "(Optional) In the password policy you have set, refers to the number of days a temporary password is valid. If the user does not sign-in during this time, their password will need to be reset by an administrator."
default = 1
}
#### Lambda
variable "lambda_create_auth_challenge" {
type = string
description = "(Optional) The ARN of an AWS Lambda creating an authentication challenge."
default = null
}
variable "lambda_custom_message" {
type = string
description = "(Optional) The ARN of a custom message AWS Lambda trigger."
default = null
}
variable "lambda_define_auth_challenge" {
type = string
description = "(Optional) The ARN of an AWS Lambda that defines the authentication challenge."
default = null
}
variable "lambda_post_authentication" {
type = string
description = "(Optional) The ARN of a post-authentication AWS Lambda trigger."
default = null
}
variable "lambda_post_confirmation" {
type = string
description = "(Optional) The ARN of a post-confirmation AWS Lambda trigger."
default = null
}
variable "lambda_pre_authentication" {
type = string
description = "(Optional) The ARN of a pre-authentication AWS Lambda trigger."
default = null
}
variable "lambda_pre_sign_up" {
type = string
description = "(Optional) The ARN of a pre-registration AWS Lambda trigger."
default = null
}
variable "lambda_pre_token_generation" {
type = string
description = "(Optional) The ARN of an AWS Lambda that allows customization of identity token claims before token generation."
default = null
}
variable "lambda_user_migration" {
type = string
description = "(Optional) The ARN of the user migration AWS Lambda config type."
default = null
}
variable "lambda_verify_auth_challenge_response" {
type = string
description = "(Optional) The ARN of an AWS Lambda that verifies the authentication challenge response."
default = null
}
## Schema Atribute
variable "schema_attributes" {
description = "(Optional) A list of schema attributes of a user pool. You can add a maximum of 25 custom attributes."
type = any
# Example:
#
# schema_attributes = [
# {
# name = "alternative_name"
# type = "String"
# developer_only_attribute = false,
# mutable = true,
# required = false,
# min_length = 0,
# max_length = 2048
# },
# {
# name = "friends_count"
# type = "Number"
# min_value = 0,
# max_value = 100
#
# },
# {
#
# name = "is_active"
# type = "Boolean"
#
# },
# {
# name = "last_seen"
# type = "DateTime"
#
# }
# ]
default = []
}
#########################################################################################################################################
### Client
#########################################################################################################################################
variable "client_allowed_oauth_flows" {
description = "(Optional) List of allowed OAuth flows. Possible flows are 'code', 'implicit', and 'client_credentials'."
type = list(string)
default = null
}
variable "client_allowed_oauth_flows_user_pool_client" {
description = "(Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito User Pools."
type = bool
default = null
}
variable "client_allowed_oauth_scopes" {
description = "(Optional) List of allowed OAuth scopes. Possible values are 'phone', 'email', 'openid', 'profile', and 'aws.cognito.signin.user.admin'."
type = list(string)
default = null
}
variable "client_callback_urls" {
description = "(Optional) List of allowed callback URLs for the identity providers."
type = list(string)
default = null
}
variable "client_default_redirect_uri" {
description = "(Optional) The default redirect URI. Must be in the list of callback URLs."
type = string
default = null
}
variable "client_explicit_auth_flows" {
description = "(Optional) List of authentication flows. Possible values are 'ADMIN_NO_SRP_AUTH', 'CUSTOM_AUTH_FLOW_ONLY', 'USER_PASSWORD_AUTH', 'ALLOW_ADMIN_USER_PASSWORD_AUTH', 'ALLOW_CUSTOM_AUTH', 'ALLOW_USER_PASSWORD_AUTH', 'ALLOW_USER_SRP_AUTH', and 'ALLOW_REFRESH_TOKEN_AUTH'."
type = list(string)
default = null
}
variable "client_generate_secret" {
description = "Should an application secret be generated"
type = bool
default = true
}
variable "client_logout_urls" {
description = "(Optional) List of allowed logout URLs for the identity providers."
type = list(string)
default = null
}
variable "client_read_attributes" {
description = "(Optional) List of Cognito User Pool attributes the application client can read from."
type = list(string)
default = ["address", "birthdate", "email", "email_verified", "family_name", "gender", "given_name", "locale", "middle_name", "name", "nickname", "phone_number", "phone_number_verified", "picture", "preferred_username", "profile", "updated_at", "website", "zoneinfo"]
}
variable "client_refresh_token_validity" {
description = "(Optional) The time limit in days refresh tokens are valid for."
type = number
default = 30
}
variable "client_prevent_user_existence_errors" {
description = "(Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the Cognito User Pool. When set to 'ENABLED' and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to 'LEGACY', those APIs will return a 'UserNotFoundException' exception if the user does not exist in the Cognito User Pool."
type = string
default = null
}
variable "client_supported_identity_providers" {
description = "(Optional) List of provider names for the identity providers that are supported on this client."
type = list(string)
default = null
}
variable "client_write_attributes" {
description = "(Optional) List of Cognito User Pool attributes the application client can write to."
type = list(string)
default = ["address", "birthdate", "email", "family_name", "gender", "given_name", "locale", "middle_name", "name", "nickname", "phone_number", "picture", "preferred_username", "profile", "updated_at", "website", "zoneinfo"]
}
variable "client_access_token_validity" {
description = "(Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. This value will be overridden if you have entered a value in 'default_client_token_validity_units'."
type = number
default = null
}
variable "client_id_token_validity" {
description = "(Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. This value will be overridden if you have entered a value in 'default_client_token_validity_units'."
type = number
default = null
}
variable "client_token_validity_units" {
description = "(Optional) Configuration block for units in which the validity times are represented in."
type = any
default = null
}
variable "client_enable_token_revocation" {
description = "(Optional) Enables or disables token revocation."
type = bool
default = null
}
variable "client_name" {
description = "The name of the application client"
type = string
default = null
}
variable "email_subject" {
description = "The name of the email subject"
type = string
default = "Sign up for <project_name>."
}
variable "clients" {
description = "A container with the clients definitions"
type = any
default = []
}
variable "module_depends_on" {
type = any
description = "(Optional) A list of external resources the module depends_on."
default = []
}
#########################################################################################################################################
### Domain
#########################################################################################################################################
variable "domain" {
description = "Cognito User Pool domain"
type = string
default = null
}
variable "domain_certificate_arn" {
description = "The ARN of an ISSUED ACM certificate in us-east-1 for a custom domain"
type = string
default = null
}
variable "allow_unauthenticated_identities" {
description = "Whether the identity pool supports unauthenticated logins or not."
type = bool
default = false
}
#########################################################################################################################################
### User Group
#########################################################################################################################################
variable "user_group_name" {
description = "The name of the user group"
type = string
default = null
}
variable "user_group_description" {
description = "The description of the user group"
type = string
default = null
}
variable "user_group_precedence" {
description = "The precedence of the user group"
type = number
default = null
}
variable "user_group_role_arn" {
description = "The ARN of the IAM role to be associated with the user group"
type = string
default = null
}
variable "user_groups" {
description = "A container with the user_groups definitions"
type = list(any)
default = []
}
################################################
## Create USer
################################################
variable "users" {
description = "Dynamic list of Cognito Users to create (email)"
type = map(
object({
email = string
})
)
}
variable "desired_delivery_mediums" {
description = "A list of mediums to the welcome message will be sent through. Allowed values are `EMAIL` and `SMS`. If it's provided, make sure you have also specified `email` attribute for the `EMAIL` medium and `phone_number` for the `SMS`. More than one value can be specified."
type = list(string)
default = ["EMAIL"]
}
#########################################################################################################################################
# Resource Server
#########################################################################################################################################
variable "resource_servers" {
description = "A list of Resource Server configuration."
type = list(any)
default = []
}