{"id":30450055,"url":"https://github.com/cruxstack/terraform-aws-cognito-hooks","last_synced_at":"2026-02-12T04:44:53.950Z","repository":{"id":310125585,"uuid":"1038762827","full_name":"cruxstack/terraform-aws-cognito-hooks","owner":"cruxstack","description":null,"archived":false,"fork":false,"pushed_at":"2025-08-15T23:24:28.000Z","size":11,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-15T23:36:22.361Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cruxstack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-15T19:15:52.000Z","updated_at":"2025-08-15T19:27:24.000Z","dependencies_parsed_at":"2025-08-15T23:48:12.515Z","dependency_job_id":null,"html_url":"https://github.com/cruxstack/terraform-aws-cognito-hooks","commit_stats":null,"previous_names":["cruxstack/terraform-aws-cognito-hooks"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/cruxstack/terraform-aws-cognito-hooks","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cognito-hooks","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cognito-hooks/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cognito-hooks/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cognito-hooks/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cruxstack","download_url":"https://codeload.github.com/cruxstack/terraform-aws-cognito-hooks/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cognito-hooks/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":271749047,"owners_count":24814114,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-23T02:00:09.327Z","response_time":69,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-08-23T13:22:21.541Z","updated_at":"2026-02-12T04:44:48.931Z","avatar_url":"https://github.com/cruxstack.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-aws-cognito-hooks\n\nThis Terraform module deploys an AWS Lambda function to serve as a Cognito\nhook. It evaluates Open Policy Agent (OPA) policies to allow or deny the\nrequest and can enrich policy input with optional SendGrid email verification.\n\n_For now, only the **PreSignUp** hook is supported._\n\nFor details about the PreSignUp Lambda implementation, see the\n[documentation](./assets/presignup-hook/) inside its directory. The binary is\nbuilt from [`cruxstack/cognito-hooks-go`](https://github.com/cruxstack/cognito-hooks-go)\nat a ref you choose, and the OPA (Rego v1) policy is injected at build time.\n\n## Features\n\n- [PreSignUp hook Lambda for Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.html)\n  - customizable OPA policy to allow/deny and set response flags\n    (`autoConfirmUser`, `autoVerifyEmail`, `autoVerifyPhone`)\n  - optional SendGrid email verification enrichment as policy input\n- operational ergonomics\n  - CloudWatch log group with 90-day retention\n  - X-Ray tracing enabled\n  - tags and naming via `cloudposse/label/null`\n\n## Usage\n\n```hcl\nlocals {\n  # minimal allow-all policy (rego v1)\n  presignup_hook_policy_content = \u003c\u003c-EOT\n    package cognito_hook_presignup\n    import rego.v1\n\n    result := {\n      \"action\": \"allow\",\n      \"response\": {}\n    }\n  EOT\n}\n\nmodule \"cognito_hooks\" {\n  source = \"github.com/cruxstack/terraform-aws-cognito-hooks?ref=x.x.x\"\n\n  presignup_hook_enabled        = true\n  presignup_hook_policy_content = local.presignup_hook_policy_content\n}\n\nresource \"aws_cognito_user_pool\" \"this\" {\n  name = \"my-user-pool\"\n\n  lambda_config {\n    pre_sign_up = module.cognito_hooks.presignup_hook_lambda_fn_arn\n  }\n}\n````\n\n## Policy Contract\n\n- policy must begin with: `package cognito_hook_\u003chook-name\u003e`\n  - example: `package cognito_hook_presignup`\n- include `import rego.v1`\n- bind a `result` object:\n\n    ```rego\n    # allow\n    result := {\n      \"action\": \"allow\",\n      \"response\": {\n        # optional: \"autoConfirmUser\", \"autoVerifyEmail\", \"autoVerifyPhone\"\n      }\n    }\n    # deny\n    result := {\n      \"action\": \"deny\",\n      \"reason\": \"message shown in logs\"\n    }\n    ```\n\n## Inputs\n\nIn addition to the variables documented below, this module includes several\nother optional variables (e.g., `name`, `tags`, etc.) provided by the\n`cloudposse/label/null` module. Please refer to its [documentation](https://registry.terraform.io/modules/cloudposse/label/null/latest)\nfor more details on these variables.\n\n| Name                                                    | Description                                                                 |      Type      |    Default   | Required |\n| ------------------------------------------------------- | --------------------------------------------------------------------------- | :------------: | :----------: | :------: |\n| `service_log_level`                                     | log level: `debug`, `info`, `warn`, `error`                                 |    `string`    |   `\"info\"`   |    no    |\n| `presignup_hook_version`                                | version or git ref of the hook source (`cognito-hooks-go`)                  |    `string`    |  `\"latest\"`  |    no    |\n| `presignup_hook_enabled`                                | whether the PreSignUp hook is deployed                                      |     `bool`     |    `false`   |    no    |\n| `presignup_hook_debug_enabled`                          | enable additional debug logging                                             |     `bool`     |    `false`   |    no    |\n| `presignup_hook_policy_content`                         | OPA (rego v1) policy content                                                |    `string`    |      n/a     |  **yes** |\n| `presignup_hook_email_verification_enabled`             | enable SendGrid email verification enrichment                               |     `bool`     |    `false`   |    no    |\n| `presignup_hook_email_verification_for_trigger_sources` | trigger sources to verify (`SignUp`, `AdminCreateUser`, `ExternalProvider`) | `list(string)` | `[\"SignUp\"]` |    no    |\n| `presignup_hook_email_verification_whitelist`           | email domains that bypass verification                                      | `list(string)` |     `[]`     |    no    |\n| `sendgrid_email_verification_api_key`                   | SendGrid API key                                                            |    `string`    |     `\"\"`     |    no    |\n\n## Outputs\n\n| Name                           | Description                                                       |\n| ------------------------------ | ----------------------------------------------------------------- |\n| `presignup_hook_lambda_fn_arn` | the ARN of the Lambda function, or null if the module is disabled |\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcruxstack%2Fterraform-aws-cognito-hooks","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcruxstack%2Fterraform-aws-cognito-hooks","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcruxstack%2Fterraform-aws-cognito-hooks/lists"}