{"id":48839234,"url":"https://github.com/sourcefuse/terraform-aws-arc-cognito-userpool","last_synced_at":"2026-04-15T01:02:51.141Z","repository":{"id":314470049,"uuid":"1033719920","full_name":"sourcefuse/terraform-aws-arc-cognito-userpool","owner":"sourcefuse","description":null,"archived":false,"fork":false,"pushed_at":"2025-09-15T11:03:49.000Z","size":3836,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-02T04:29:26.693Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sourcefuse.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-08-07T08:41:53.000Z","updated_at":"2025-09-15T11:03:30.000Z","dependencies_parsed_at":"2025-09-12T18:20:02.201Z","dependency_job_id":"eb514a7a-d453-44bb-a8f3-268803698084","html_url":"https://github.com/sourcefuse/terraform-aws-arc-cognito-userpool","commit_stats":null,"previous_names":["sourcefuse/terraform-aws-arc-cognito-userpool"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/sourcefuse/terraform-aws-arc-cognito-userpool","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-cognito-userpool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-cognito-userpool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-cognito-userpool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-cognito-userpool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sourcefuse","download_url":"https://codeload.github.com/sourcefuse/terraform-aws-arc-cognito-userpool/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sourcefuse%2Fterraform-aws-arc-cognito-userpool/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31821685,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-14T18:05:02.291Z","status":"ssl_error","status_checked_at":"2026-04-14T18:05:01.765Z","response_time":153,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-04-15T01:02:47.859Z","updated_at":"2026-04-15T01:02:51.100Z","avatar_url":"https://github.com/sourcefuse.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Module Structure](./static/cognito-banner.png)\n## [terraform-aws-arc-cognito-userpool](https://github.com/sourcefuse/terraform-aws-arc-cognito-userpool)\n![Terraform](https://img.shields.io/badge/terraform-%235835CC.svg?style=for-the-badge\u0026logo=terraform\u0026logoColor=white)\n![GitHub Actions](https://img.shields.io/badge/github%20actions-%232671E5.svg?style=for-the-badge\u0026logo=githubactions\u0026logoColor=white)\n\n[![Quality gate](https://sonarcloud.io/api/project_badges/quality_gate?project=sourcefuse_terraform-aws-arc-cognito-userpool\u0026token=e28bfe630069bd645a51dee7e25cf3c7e522e9fd)](https://sonarcloud.io/summary/new_code?id=sourcefuse_terraform-aws-arc-cognito-userpool)\n\n\n\n## Overview\nSourceFuse AWS Reference Architecture (ARC) Terraform module for managing the cognito userpool module.\n## Features\n- **Complete Cognito User Pool Management**: Create and configure user pools with all available settings.\n- **Security Best Practices**: Built-in security configurations following AWS recommendations.\n- **Flexible Client Configuration**: Support for multiple app clients with different configurations.\n- **Identity Provider Integration**: Support for SAML, OIDC, and social identity providers.\n- **Advanced Security Features**: MFA, advanced security mode, adaptive authentication.\n- **Lambda Triggers**: Support for all Cognito Lambda triggers.\n- **Custom Domains**: Support for custom domains with SSL certificates.\n- **User Pool Groups**: Role-based access control with user groups.\n- **Resource Servers**: OAuth 2.0 resource server configuration.\n\n ## Usage\n To see a full example, check out the [main.tf](https://github.com/sourcefuse/terraform-aws-arc-cognito-userpool/blob/main/examples/basic-user-pool/main.tf) file in the example folder.\n\n```hcl\nmodule \"arc-cognito-userpool\" {\n  source  = \"sourcefuse/arc-cognito-userpool/aws\"\n  version = \"1.0.0\"\n\n  environment      = \"dev\"\n  project          = \"arc\"\n  name             = \"auth\"\n  region           = \"us-east-1\"\n\n  # Example basic config\n  cognito_user_pool_name = \"arc-demo-user-pool\"\n  # Add further required variables\n}\n```\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.6.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 5.0, \u003c 7.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | 6.12.0 |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_s3\"\u003e\u003c/a\u003e [s3](#module\\_s3) | sourcefuse/arc-s3/aws | 0.0.5 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |\n| [aws_cloudwatch_log_resource_policy.cognito](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_resource_policy) | resource |\n| [aws_cognito_identity_provider.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_identity_provider) | resource |\n| [aws_cognito_log_delivery_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_log_delivery_configuration) | resource |\n| [aws_cognito_resource_server.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_resource_server) | resource |\n| [aws_cognito_risk_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_risk_configuration) | resource |\n| [aws_cognito_user.users](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user) | resource |\n| [aws_cognito_user_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_group) | resource |\n| [aws_cognito_user_in_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_in_group) | resource |\n| [aws_cognito_user_pool.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool) | resource |\n| [aws_cognito_user_pool_client.hosted_ui](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_client) | resource |\n| [aws_cognito_user_pool_client.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_client) | resource |\n| [aws_cognito_user_pool_domain.hosted_ui](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_domain) | resource |\n| [aws_cognito_user_pool_domain.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_domain) | resource |\n| [aws_cognito_user_pool_ui_customization.hosted_ui](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_ui_customization) | resource |\n| [aws_wafv2_web_acl_association.cognito_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl_association) | resource |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_account_recovery_mechanisms\"\u003e\u003c/a\u003e [account\\_recovery\\_mechanisms](#input\\_account\\_recovery\\_mechanisms) | List of account recovery mechanisms | \u003cpre\u003elist(object({\u003cbr/\u003e    name     = string\u003cbr/\u003e    priority = number\u003cbr/\u003e  }))\u003c/pre\u003e | \u003cpre\u003e[\u003cbr/\u003e  {\u003cbr/\u003e    \"name\": \"verified_email\",\u003cbr/\u003e    \"priority\": 1\u003cbr/\u003e  }\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_account_takeover_risk_configuration\"\u003e\u003c/a\u003e [account\\_takeover\\_risk\\_configuration](#input\\_account\\_takeover\\_risk\\_configuration) | n/a | \u003cpre\u003eobject({\u003cbr/\u003e    notify_configuration = object({\u003cbr/\u003e      from       = optional(string)\u003cbr/\u003e      reply_to   = optional(string)\u003cbr/\u003e      source_arn = string\u003cbr/\u003e      block_email = optional(object({\u003cbr/\u003e        html_body = string\u003cbr/\u003e        text_body = string\u003cbr/\u003e        subject   = string\u003cbr/\u003e      }))\u003cbr/\u003e      mfa_email = optional(object({\u003cbr/\u003e        html_body = string\u003cbr/\u003e        text_body = string\u003cbr/\u003e        subject   = string\u003cbr/\u003e      }))\u003cbr/\u003e      no_action_email = optional(object({\u003cbr/\u003e        html_body = string\u003cbr/\u003e        text_body = string\u003cbr/\u003e        subject   = string\u003cbr/\u003e      }))\u003cbr/\u003e    })\u003cbr/\u003e    actions = object({\u003cbr/\u003e      high_action = object({\u003cbr/\u003e        event_action = string\u003cbr/\u003e        notify       = bool\u003cbr/\u003e      })\u003cbr/\u003e      medium_action = object({\u003cbr/\u003e        event_action = string\u003cbr/\u003e        notify       = bool\u003cbr/\u003e      })\u003cbr/\u003e      low_action = object({\u003cbr/\u003e        event_action = string\u003cbr/\u003e        notify       = bool\u003cbr/\u003e      })\u003cbr/\u003e    })\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_admin_create_user_config\"\u003e\u003c/a\u003e [admin\\_create\\_user\\_config](#input\\_admin\\_create\\_user\\_config) | Configuration for creating a new user profile | \u003cpre\u003eobject({\u003cbr/\u003e    allow_admin_create_user_only = optional(bool, false)\u003cbr/\u003e    invite_message_template = optional(object({\u003cbr/\u003e      email_message = optional(string)\u003cbr/\u003e      email_subject = optional(string)\u003cbr/\u003e      sms_message   = optional(string)\u003cbr/\u003e    }), {})\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_alias_attributes\"\u003e\u003c/a\u003e [alias\\_attributes](#input\\_alias\\_attributes) | Attributes supported as an alias for this user pool. Valid values: phone\\_number, email, or preferred\\_username | `list(string)` | `[]` | no |\n| \u003ca name=\"input_auto_verified_attributes\"\u003e\u003c/a\u003e [auto\\_verified\\_attributes](#input\\_auto\\_verified\\_attributes) | Attributes to be auto-verified. Valid values: email, phone\\_number | `list(string)` | `[]` | no |\n| \u003ca name=\"input_cognito_log_delivery_config\"\u003e\u003c/a\u003e [cognito\\_log\\_delivery\\_config](#input\\_cognito\\_log\\_delivery\\_config) | ============================================================================== VARIABLES - LOG STREAMING ============================================================================== | \u003cpre\u003eobject({\u003cbr/\u003e    event_source         = string # e.g. \"userAuthEvents\" or \"userNotification\"\u003cbr/\u003e    log_level            = string # \"ERROR\" or \"INFO\"\u003cbr/\u003e    log_destination_type = string # \"cloudwatch\", \"s3\", \"firehose\"\u003cbr/\u003e\u003cbr/\u003e    # Optional overrides\u003cbr/\u003e    log_group_name      = optional(string) # for CW logs\u003cbr/\u003e    s3_bucket_name      = optional(string) # for S3\u003cbr/\u003e    firehose_stream_arn = optional(string) # for Firehose\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_compromised_credentials_risk_configuration\"\u003e\u003c/a\u003e [compromised\\_credentials\\_risk\\_configuration](#input\\_compromised\\_credentials\\_risk\\_configuration) | n/a | \u003cpre\u003eobject({\u003cbr/\u003e    event_filter = optional(list(string))\u003cbr/\u003e    actions = object({\u003cbr/\u003e      event_action = string\u003cbr/\u003e    })\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_create_resource_servers\"\u003e\u003c/a\u003e [create\\_resource\\_servers](#input\\_create\\_resource\\_servers) | Whether to create resource servers | `bool` | `false` | no |\n| \u003ca name=\"input_create_user_pool_clients\"\u003e\u003c/a\u003e [create\\_user\\_pool\\_clients](#input\\_create\\_user\\_pool\\_clients) | Whether to create user pool clients | `bool` | `true` | no |\n| \u003ca name=\"input_create_user_pool_domain\"\u003e\u003c/a\u003e [create\\_user\\_pool\\_domain](#input\\_create\\_user\\_pool\\_domain) | Whether to create user pool domain | `bool` | `false` | no |\n| \u003ca name=\"input_create_user_pool_groups\"\u003e\u003c/a\u003e [create\\_user\\_pool\\_groups](#input\\_create\\_user\\_pool\\_groups) | Whether to create user pool groups | `bool` | `false` | no |\n| \u003ca name=\"input_create_user_pool_users\"\u003e\u003c/a\u003e [create\\_user\\_pool\\_users](#input\\_create\\_user\\_pool\\_users) | Whether to create user pool users | `bool` | `false` | no |\n| \u003ca name=\"input_deletion_protection\"\u003e\u003c/a\u003e [deletion\\_protection](#input\\_deletion\\_protection) | When active, DeletionProtection prevents accidental deletion of your user pool | `string` | `\"INACTIVE\"` | no |\n| \u003ca name=\"input_device_configuration\"\u003e\u003c/a\u003e [device\\_configuration](#input\\_device\\_configuration) | Configuration for the user pool's device tracking | \u003cpre\u003eobject({\u003cbr/\u003e    challenge_required_on_new_device      = optional(bool, false)\u003cbr/\u003e    device_only_remembered_on_user_prompt = optional(bool, false)\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_email_configuration\"\u003e\u003c/a\u003e [email\\_configuration](#input\\_email\\_configuration) | Configuration for email settings | \u003cpre\u003eobject({\u003cbr/\u003e    configuration_set      = optional(string)\u003cbr/\u003e    email_sending_account  = optional(string, \"COGNITO_DEFAULT\")\u003cbr/\u003e    from_email_address     = optional(string)\u003cbr/\u003e    reply_to_email_address = optional(string)\u003cbr/\u003e    source_arn             = optional(string)\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_email_verification_message\"\u003e\u003c/a\u003e [email\\_verification\\_message](#input\\_email\\_verification\\_message) | String representing the email verification message | `string` | `null` | no |\n| \u003ca name=\"input_email_verification_subject\"\u003e\u003c/a\u003e [email\\_verification\\_subject](#input\\_email\\_verification\\_subject) | String representing the email verification subject | `string` | `null` | no |\n| \u003ca name=\"input_hosted_ui_config\"\u003e\u003c/a\u003e [hosted\\_ui\\_config](#input\\_hosted\\_ui\\_config) | Cognito Hosted UI configuration | \u003cpre\u003eobject({\u003cbr/\u003e    name                                 = string\u003cbr/\u003e    domain                               = string\u003cbr/\u003e    certificate_arn                      = optional(string)\u003cbr/\u003e    callback_urls                        = list(string)\u003cbr/\u003e    logout_urls                          = list(string)\u003cbr/\u003e    default_redirect_uri                 = optional(string)\u003cbr/\u003e    allowed_oauth_flows                  = list(string)\u003cbr/\u003e    allowed_oauth_flows_user_pool_client = optional(bool, true)\u003cbr/\u003e    allowed_oauth_scopes                 = list(string)\u003cbr/\u003e    supported_identity_providers         = list(string)\u003cbr/\u003e    generate_secret                      = optional(bool, false)\u003cbr/\u003e    css_file                             = optional(string)\u003cbr/\u003e    image_file                           = optional(string)\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_identity_providers_config\"\u003e\u003c/a\u003e [identity\\_providers\\_config](#input\\_identity\\_providers\\_config) | Configuration for optional identity providers | \u003cpre\u003eobject({\u003cbr/\u003e    google = optional(object({\u003cbr/\u003e      enabled                       = optional(bool, false)\u003cbr/\u003e      client_id                     = optional(string)\u003cbr/\u003e      client_secret                 = optional(string)\u003cbr/\u003e      scopes                        = optional(list(string), [\"openid\", \"email\", \"profile\"])\u003cbr/\u003e      attribute_mapping             = optional(map(string), {})\u003cbr/\u003e      authorize_url                 = optional(string, \"https://accounts.google.com/o/oauth2/v2/auth\")\u003cbr/\u003e      token_url                     = optional(string, \"https://www.googleapis.com/oauth2/v4/token\")\u003cbr/\u003e      attributes_url                = optional(string, \"https://people.googleapis.com/v1/people/me?personFields=\")\u003cbr/\u003e      attributes_url_add_attributes = optional(string, \"true\")\u003cbr/\u003e      oidc_issuer                   = optional(string, \"https://accounts.google.com\")\u003cbr/\u003e      token_request_method          = optional(string, \"POST\")\u003cbr/\u003e    }), {})\u003cbr/\u003e\u003cbr/\u003e    facebook = optional(object({\u003cbr/\u003e      enabled                       = optional(bool, false)\u003cbr/\u003e      app_id                        = optional(string)\u003cbr/\u003e      app_secret                    = optional(string)\u003cbr/\u003e      scopes                        = optional(list(string), [\"public_profile\", \"email\"])\u003cbr/\u003e      attribute_mapping             = optional(map(string), {})\u003cbr/\u003e      authorize_url                 = optional(string, \"https://www.facebook.com/v17.0/dialog/oauth\")\u003cbr/\u003e      token_url                     = optional(string, \"https://graph.facebook.com/v17.0/oauth/access_token\")\u003cbr/\u003e      attributes_url                = optional(string, \"https://graph.facebook.com/v17.0/me?fields=\")\u003cbr/\u003e      attributes_url_add_attributes = optional(string, \"true\")\u003cbr/\u003e      token_request_method          = optional(string, \"GET\")\u003cbr/\u003e    }), {})\u003cbr/\u003e\u003cbr/\u003e    apple = optional(object({\u003cbr/\u003e      enabled           = optional(bool, false)\u003cbr/\u003e      services_id       = optional(string)\u003cbr/\u003e      team_id           = optional(string)\u003cbr/\u003e      key_id            = optional(string)\u003cbr/\u003e      private_key       = optional(string)\u003cbr/\u003e      scopes            = optional(list(string), [\"name\", \"email\"])\u003cbr/\u003e      attribute_mapping = optional(map(string), {})\u003cbr/\u003e    }), {})\u003cbr/\u003e\u003cbr/\u003e    amazon = optional(object({\u003cbr/\u003e      enabled           = optional(bool, false)\u003cbr/\u003e      client_id         = optional(string)\u003cbr/\u003e      client_secret     = optional(string)\u003cbr/\u003e      scopes            = optional(list(string), [\"profile\"])\u003cbr/\u003e      attribute_mapping = optional(map(string), {})\u003cbr/\u003e    }), {})\u003cbr/\u003e\u003cbr/\u003e    saml = optional(object({\u003cbr/\u003e      enabled           = optional(bool, false)\u003cbr/\u003e      provider_name     = optional(string)\u003cbr/\u003e      metadata_url      = optional(string)\u003cbr/\u003e      attribute_mapping = optional(map(string), {})\u003cbr/\u003e      idp_identifiers   = optional(list(string), [])\u003cbr/\u003e    }), {})\u003cbr/\u003e\u003cbr/\u003e    oidc = optional(object({\u003cbr/\u003e      enabled           = optional(bool, false)\u003cbr/\u003e      provider_name     = optional(string)\u003cbr/\u003e      client_id         = optional(string)\u003cbr/\u003e      client_secret     = optional(string)\u003cbr/\u003e      issuer_url        = optional(string)\u003cbr/\u003e      scopes            = optional(list(string), [\"openid\", \"email\", \"profile\"])\u003cbr/\u003e      attribute_mapping = optional(map(string), {})\u003cbr/\u003e    }), {})\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_lambda_config\"\u003e\u003c/a\u003e [lambda\\_config](#input\\_lambda\\_config) | Configuration for AWS Lambda triggers associated with the user pool | \u003cpre\u003eobject({\u003cbr/\u003e    create_auth_challenge          = optional(string)\u003cbr/\u003e    custom_message                 = optional(string)\u003cbr/\u003e    define_auth_challenge          = optional(string)\u003cbr/\u003e    post_authentication            = optional(string)\u003cbr/\u003e    post_confirmation              = optional(string)\u003cbr/\u003e    pre_authentication             = optional(string)\u003cbr/\u003e    pre_sign_up                    = optional(string)\u003cbr/\u003e    pre_token_generation           = optional(string)\u003cbr/\u003e    user_migration                 = optional(string)\u003cbr/\u003e    verify_auth_challenge_response = optional(string)\u003cbr/\u003e    kms_key_id                     = optional(string)\u003cbr/\u003e    custom_email_sender = optional(object({\u003cbr/\u003e      lambda_arn     = string\u003cbr/\u003e      lambda_version = string\u003cbr/\u003e    }))\u003cbr/\u003e    custom_sms_sender = optional(object({\u003cbr/\u003e      lambda_arn     = string\u003cbr/\u003e      lambda_version = string\u003cbr/\u003e    }))\u003cbr/\u003e    pre_token_generation_config = optional(object({\u003cbr/\u003e      lambda_arn     = string\u003cbr/\u003e      lambda_version = string\u003cbr/\u003e    }))\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_mfa_configuration\"\u003e\u003c/a\u003e [mfa\\_configuration](#input\\_mfa\\_configuration) | Multi-Factor Authentication (MFA) configuration for the User Pool. Set to null to omit. | `string` | `null` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | Name of the Cognito User Pool | `string` | n/a | yes |\n| \u003ca name=\"input_password_policy\"\u003e\u003c/a\u003e [password\\_policy](#input\\_password\\_policy) | Configuration for the user pool password policy | \u003cpre\u003eobject({\u003cbr/\u003e    minimum_length                   = optional(number, 8)\u003cbr/\u003e    require_lowercase                = optional(bool, true)\u003cbr/\u003e    require_numbers                  = optional(bool, true)\u003cbr/\u003e    require_symbols                  = optional(bool, true)\u003cbr/\u003e    require_uppercase                = optional(bool, true)\u003cbr/\u003e    temporary_password_validity_days = optional(number, 7)\u003cbr/\u003e    password_history_size            = optional(number, 0)\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_resource_servers\"\u003e\u003c/a\u003e [resource\\_servers](#input\\_resource\\_servers) | List of resource servers to create | \u003cpre\u003elist(object({\u003cbr/\u003e    identifier = string\u003cbr/\u003e    name       = string\u003cbr/\u003e    scope = optional(list(object({\u003cbr/\u003e      scope_name        = string\u003cbr/\u003e      scope_description = string\u003cbr/\u003e    })), [])\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_risk_exception_configuration\"\u003e\u003c/a\u003e [risk\\_exception\\_configuration](#input\\_risk\\_exception\\_configuration) | n/a | \u003cpre\u003eobject({\u003cbr/\u003e    blocked_ip_range_list = optional(list(string))\u003cbr/\u003e    skipped_ip_range_list = optional(list(string))\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_schema\"\u003e\u003c/a\u003e [schema](#input\\_schema) | Configuration for the schema attributes of a user pool | \u003cpre\u003elist(object({\u003cbr/\u003e    attribute_data_type      = string\u003cbr/\u003e    developer_only_attribute = optional(bool, false)\u003cbr/\u003e    mutable                  = optional(bool, true)\u003cbr/\u003e    name                     = string\u003cbr/\u003e    required                 = optional(bool, false)\u003cbr/\u003e    number_attribute_constraints = optional(object({\u003cbr/\u003e      max_value = optional(string)\u003cbr/\u003e      min_value = optional(string)\u003cbr/\u003e    }))\u003cbr/\u003e    string_attribute_constraints = optional(object({\u003cbr/\u003e      max_length = optional(string)\u003cbr/\u003e      min_length = optional(string)\u003cbr/\u003e    }))\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_sms_authentication_message\"\u003e\u003c/a\u003e [sms\\_authentication\\_message](#input\\_sms\\_authentication\\_message) | String representing the SMS authentication message | `string` | `null` | no |\n| \u003ca name=\"input_sms_configuration\"\u003e\u003c/a\u003e [sms\\_configuration](#input\\_sms\\_configuration) | Configuration for SMS settings | \u003cpre\u003eobject({\u003cbr/\u003e    external_id    = string\u003cbr/\u003e    sns_caller_arn = string\u003cbr/\u003e    sns_region     = optional(string)\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_sms_verification_message\"\u003e\u003c/a\u003e [sms\\_verification\\_message](#input\\_sms\\_verification\\_message) | String representing the SMS verification message | `string` | `null` | no |\n| \u003ca name=\"input_software_token_mfa_configuration\"\u003e\u003c/a\u003e [software\\_token\\_mfa\\_configuration](#input\\_software\\_token\\_mfa\\_configuration) | Configuration for software token Multi-Factor Authentication (MFA) settings. Set to null to omit. | \u003cpre\u003eobject({\u003cbr/\u003e    enabled = bool\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | A map of tags to assign to the resources | `map(string)` | `{}` | no |\n| \u003ca name=\"input_user_attribute_update_settings\"\u003e\u003c/a\u003e [user\\_attribute\\_update\\_settings](#input\\_user\\_attribute\\_update\\_settings) | Configuration for user attribute update settings | \u003cpre\u003eobject({\u003cbr/\u003e    attributes_require_verification_before_update = list(string)\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_user_group_memberships\"\u003e\u003c/a\u003e [user\\_group\\_memberships](#input\\_user\\_group\\_memberships) | List of user-to-group memberships | \u003cpre\u003elist(object({\u003cbr/\u003e    user  = string\u003cbr/\u003e    group = string\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_user_pool_add_ons\"\u003e\u003c/a\u003e [user\\_pool\\_add\\_ons](#input\\_user\\_pool\\_add\\_ons) | Advanced security configuration for Cognito User Pool.\u003cbr/\u003e- advanced\\_security\\_mode: OFF \\| AUDIT \\| ENFORCED\u003cbr/\u003e- advanced\\_security\\_additional\\_flows: (optional) block for custom flows\u003cbr/\u003e    - custom\\_auth\\_mode: e.g. \"AUDIT\" or \"ENFORCED\" | \u003cpre\u003eobject({\u003cbr/\u003e    advanced_security_mode = string\u003cbr/\u003e    advanced_security_additional_flows = optional(object({\u003cbr/\u003e      custom_auth_mode = string\u003cbr/\u003e    }))\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_user_pool_clients\"\u003e\u003c/a\u003e [user\\_pool\\_clients](#input\\_user\\_pool\\_clients) | List of user pool clients to create | \u003cpre\u003elist(object({\u003cbr/\u003e    name                   = string\u003cbr/\u003e    access_token_validity  = optional(number, 60)\u003cbr/\u003e    id_token_validity      = optional(number, 60)\u003cbr/\u003e    refresh_token_validity = optional(number, 30)\u003cbr/\u003e    token_validity_units = optional(object({\u003cbr/\u003e      access_token  = optional(string, \"minutes\")\u003cbr/\u003e      id_token      = optional(string, \"minutes\")\u003cbr/\u003e      refresh_token = optional(string, \"days\")\u003cbr/\u003e    }), {})\u003cbr/\u003e    allowed_oauth_flows                           = optional(list(string), [])\u003cbr/\u003e    allowed_oauth_flows_user_pool_client          = optional(bool, false)\u003cbr/\u003e    allowed_oauth_scopes                          = optional(list(string), [])\u003cbr/\u003e    callback_urls                                 = optional(list(string), [])\u003cbr/\u003e    default_redirect_uri                          = optional(string)\u003cbr/\u003e    explicit_auth_flows                           = optional(list(string), [\"ALLOW_USER_SRP_AUTH\", \"ALLOW_REFRESH_TOKEN_AUTH\"])\u003cbr/\u003e    generate_secret                               = optional(bool, false)\u003cbr/\u003e    logout_urls                                   = optional(list(string), [])\u003cbr/\u003e    prevent_user_existence_errors                 = optional(string, \"ENABLED\")\u003cbr/\u003e    read_attributes                               = optional(list(string), [])\u003cbr/\u003e    supported_identity_providers                  = optional(list(string), [\"GOOGLE\"])\u003cbr/\u003e    write_attributes                              = optional(list(string), [])\u003cbr/\u003e    enable_token_revocation                       = optional(bool, true)\u003cbr/\u003e    enable_propagate_additional_user_context_data = optional(bool, false)\u003cbr/\u003e    auth_session_validity                         = optional(number, 3)\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_user_pool_domain\"\u003e\u003c/a\u003e [user\\_pool\\_domain](#input\\_user\\_pool\\_domain) | Configuration for user pool domain | \u003cpre\u003eobject({\u003cbr/\u003e    domain          = string\u003cbr/\u003e    certificate_arn = optional(string)\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_user_pool_groups\"\u003e\u003c/a\u003e [user\\_pool\\_groups](#input\\_user\\_pool\\_groups) | List of user pool groups to create | \u003cpre\u003elist(object({\u003cbr/\u003e    name        = string\u003cbr/\u003e    description = optional(string)\u003cbr/\u003e    precedence  = optional(number)\u003cbr/\u003e    role_arn    = optional(string)\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_user_pool_tier\"\u003e\u003c/a\u003e [user\\_pool\\_tier](#input\\_user\\_pool\\_tier) | The user pool feature plan, or tier | `string` | `\"ESSENTIALS\"` | no |\n| \u003ca name=\"input_user_pool_users\"\u003e\u003c/a\u003e [user\\_pool\\_users](#input\\_user\\_pool\\_users) | List of Cognito users to create | \u003cpre\u003elist(object({\u003cbr/\u003e    username = string\u003cbr/\u003e    email    = string\u003cbr/\u003e    password = string\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_username_attributes\"\u003e\u003c/a\u003e [username\\_attributes](#input\\_username\\_attributes) | Whether email addresses or phone numbers can be specified as usernames when a user signs up | `list(string)` | `[]` | no |\n| \u003ca name=\"input_username_configuration\"\u003e\u003c/a\u003e [username\\_configuration](#input\\_username\\_configuration) | Configuration for username settings | \u003cpre\u003eobject({\u003cbr/\u003e    case_sensitive = optional(bool, false)\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_verification_message_template\"\u003e\u003c/a\u003e [verification\\_message\\_template](#input\\_verification\\_message\\_template) | Configuration for verification message templates | \u003cpre\u003eobject({\u003cbr/\u003e    default_email_option  = optional(string, \"CONFIRM_WITH_CODE\")\u003cbr/\u003e    email_message         = optional(string)\u003cbr/\u003e    email_message_by_link = optional(string)\u003cbr/\u003e    email_subject         = optional(string)\u003cbr/\u003e    email_subject_by_link = optional(string)\u003cbr/\u003e    sms_message           = optional(string)\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_web_acl_arn\"\u003e\u003c/a\u003e [web\\_acl\\_arn](#input\\_web\\_acl\\_arn) | Optional WAF Web ACL ARN to associate with Cognito User Pool. Null = inactive | `string` | `null` | no |\n| \u003ca name=\"input_web_authn_configuration\"\u003e\u003c/a\u003e [web\\_authn\\_configuration](#input\\_web\\_authn\\_configuration) | Configuration for web authn (passkey) settings | \u003cpre\u003eobject({\u003cbr/\u003e    relying_party_id  = optional(string)\u003cbr/\u003e    user_verification = optional(string, \"preferred\")\u003cbr/\u003e  })\u003c/pre\u003e | `null` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_identity_provider_names\"\u003e\u003c/a\u003e [identity\\_provider\\_names](#output\\_identity\\_provider\\_names) | The names of the Cognito Identity Providers |\n| \u003ca name=\"output_identity_providers\"\u003e\u003c/a\u003e [identity\\_providers](#output\\_identity\\_providers) | Map of identity provider details |\n| \u003ca name=\"output_resource_server_identifiers\"\u003e\u003c/a\u003e [resource\\_server\\_identifiers](#output\\_resource\\_server\\_identifiers) | The identifiers of the Cognito Resource Servers |\n| \u003ca name=\"output_resource_server_names\"\u003e\u003c/a\u003e [resource\\_server\\_names](#output\\_resource\\_server\\_names) | The names of the Cognito Resource Servers |\n| \u003ca name=\"output_resource_servers\"\u003e\u003c/a\u003e [resource\\_servers](#output\\_resource\\_servers) | Map of resource server details |\n| \u003ca name=\"output_summary\"\u003e\u003c/a\u003e [summary](#output\\_summary) | Summary of all created resources |\n| \u003ca name=\"output_user_pool_arn\"\u003e\u003c/a\u003e [user\\_pool\\_arn](#output\\_user\\_pool\\_arn) | The ARN of the Cognito User Pool |\n| \u003ca name=\"output_user_pool_client_ids\"\u003e\u003c/a\u003e [user\\_pool\\_client\\_ids](#output\\_user\\_pool\\_client\\_ids) | The IDs of the Cognito User Pool Clients |\n| \u003ca name=\"output_user_pool_client_names\"\u003e\u003c/a\u003e [user\\_pool\\_client\\_names](#output\\_user\\_pool\\_client\\_names) | The names of the Cognito User Pool Clients |\n| \u003ca name=\"output_user_pool_client_secrets\"\u003e\u003c/a\u003e [user\\_pool\\_client\\_secrets](#output\\_user\\_pool\\_client\\_secrets) | The client secrets of the Cognito User Pool Clients (sensitive) |\n| \u003ca name=\"output_user_pool_clients\"\u003e\u003c/a\u003e [user\\_pool\\_clients](#output\\_user\\_pool\\_clients) | Map of user pool client details |\n| \u003ca name=\"output_user_pool_creation_date\"\u003e\u003c/a\u003e [user\\_pool\\_creation\\_date](#output\\_user\\_pool\\_creation\\_date) | The date the Cognito User Pool was created |\n| \u003ca name=\"output_user_pool_custom_domain\"\u003e\u003c/a\u003e [user\\_pool\\_custom\\_domain](#output\\_user\\_pool\\_custom\\_domain) | The custom domain name for the user pool |\n| \u003ca name=\"output_user_pool_domain\"\u003e\u003c/a\u003e [user\\_pool\\_domain](#output\\_user\\_pool\\_domain) | The domain prefix if the user pool has a domain associated with it |\n| \u003ca name=\"output_user_pool_domain_aws_account_id\"\u003e\u003c/a\u003e [user\\_pool\\_domain\\_aws\\_account\\_id](#output\\_user\\_pool\\_domain\\_aws\\_account\\_id) | The AWS account ID for the user pool domain |\n| \u003ca name=\"output_user_pool_domain_cloudfront_distribution_arn\"\u003e\u003c/a\u003e [user\\_pool\\_domain\\_cloudfront\\_distribution\\_arn](#output\\_user\\_pool\\_domain\\_cloudfront\\_distribution\\_arn) | The ARN of the CloudFront distribution for the domain |\n| \u003ca name=\"output_user_pool_domain_name\"\u003e\u003c/a\u003e [user\\_pool\\_domain\\_name](#output\\_user\\_pool\\_domain\\_name) | The domain name of the Cognito User Pool Domain |\n| \u003ca name=\"output_user_pool_domain_s3_bucket\"\u003e\u003c/a\u003e [user\\_pool\\_domain\\_s3\\_bucket](#output\\_user\\_pool\\_domain\\_s3\\_bucket) | The S3 bucket where the static files for this domain are stored |\n| \u003ca name=\"output_user_pool_domain_version\"\u003e\u003c/a\u003e [user\\_pool\\_domain\\_version](#output\\_user\\_pool\\_domain\\_version) | The app version for the domain |\n| \u003ca name=\"output_user_pool_endpoint\"\u003e\u003c/a\u003e [user\\_pool\\_endpoint](#output\\_user\\_pool\\_endpoint) | The endpoint name of the Cognito User Pool |\n| \u003ca name=\"output_user_pool_estimated_number_of_users\"\u003e\u003c/a\u003e [user\\_pool\\_estimated\\_number\\_of\\_users](#output\\_user\\_pool\\_estimated\\_number\\_of\\_users) | A number estimating the size of the user pool |\n| \u003ca name=\"output_user_pool_group_names\"\u003e\u003c/a\u003e [user\\_pool\\_group\\_names](#output\\_user\\_pool\\_group\\_names) | The names of the Cognito User Pool Groups |\n| \u003ca name=\"output_user_pool_groups\"\u003e\u003c/a\u003e [user\\_pool\\_groups](#output\\_user\\_pool\\_groups) | Map of user pool group details |\n| \u003ca name=\"output_user_pool_hosted_ui_url\"\u003e\u003c/a\u003e [user\\_pool\\_hosted\\_ui\\_url](#output\\_user\\_pool\\_hosted\\_ui\\_url) | The URL of the hosted UI for the user pool (if domain is configured) |\n| \u003ca name=\"output_user_pool_id\"\u003e\u003c/a\u003e [user\\_pool\\_id](#output\\_user\\_pool\\_id) | The ID of the Cognito User Pool |\n| \u003ca name=\"output_user_pool_issuer\"\u003e\u003c/a\u003e [user\\_pool\\_issuer](#output\\_user\\_pool\\_issuer) | The issuer URL for the user pool |\n| \u003ca name=\"output_user_pool_jwks_uri\"\u003e\u003c/a\u003e [user\\_pool\\_jwks\\_uri](#output\\_user\\_pool\\_jwks\\_uri) | The JSON Web Key Set (JWKS) URI for the user pool |\n| \u003ca name=\"output_user_pool_last_modified_date\"\u003e\u003c/a\u003e [user\\_pool\\_last\\_modified\\_date](#output\\_user\\_pool\\_last\\_modified\\_date) | The date the Cognito User Pool was last modified |\n| \u003ca name=\"output_user_pool_name\"\u003e\u003c/a\u003e [user\\_pool\\_name](#output\\_user\\_pool\\_name) | The name of the Cognito User Pool |\n\u003c!-- END_TF_DOCS --\u003e\n\n## Development\n\n### Prerequisites\n\n- [terraform](https://learn.hashicorp.com/terraform/getting-started/install#installing-terraform)\n- [terraform-docs](https://github.com/segmentio/terraform-docs)\n- [pre-commit](https://pre-commit.com/#install)\n- [golang](https://golang.org/doc/install#install)\n- [golint](https://github.com/golang/lint#installation)\n\n### Configurations\n\n- Configure pre-commit hooks\n  ```sh\n  pre-commit install\n  ```\n\n### Versioning\n\nwhile Contributing or doing git commit please specify the breaking change in your commit message whether its major,minor or patch\n\nFor Example\n\n```sh\ngit commit -m \"your commit message #major\"\n```\nBy specifying this , it will bump the version and if you don't specify this in your commit message then by default it will consider patch and will bump that accordingly\n\n## Authors\n\nThis project is authored by:\n- SourceFuse ARC Team\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsourcefuse%2Fterraform-aws-arc-cognito-userpool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsourcefuse%2Fterraform-aws-arc-cognito-userpool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsourcefuse%2Fterraform-aws-arc-cognito-userpool/lists"}