Terraform resource: aws cognito user group

aws_cognito_user_group, tf.io

resource "aws_cognito_user_pool" "main" {
  name = "identity pool"
}

data "aws_iam_policy_document" "group_role" {
 statement {
   effect = "Allow"

   principals {
     type        = "Federated"
     identifiers = ["cognito-identity.amazonaws.com"]
   }

   actions = ["sts:AssumeRoleWithWebIdentity"]

   condition {
     test     = "StringEquals"
     variable = "cognito-identity.amazonaws.com:aud"
     values   = ["us-east-1:12345678-dead-beef-cafe-123456790ab"]
   }

   condition {
     test     = "ForAnyValue:StringLike"
     variable = "cognito-identity.amazonaws.com:amr"
     values   = ["authenticated"]
   }
 }
}

resource "aws_iam_role" "group_role" {
 name               = "user-group-role"
 assume_role_policy = data.aws_iam_policy_document.group_role.json
}

resource "aws_cognito_user_group" "main" {
 name         = "user-group"
 user_pool_id = aws_cognito_user_pool.main.id
 description  = "Managed by Terraform"
 precedence   = 42
 role_arn     = aws_iam_role.group_role.arn
}

Related

data.aws_iam_policy_document
aws_cognito_user_pool

See also

• Terraform AWS Cognito: aws_cognito_user_pool, aws_cognito_user_group, aws_cognito_user_pool_client, cognito-identity.amazonaws.com