Skip to content

Commit 7622c46

Browse files
ZordrakZordrak
committed
v2.0.1 - Updated examples/generics
1 parent 4d496e7 commit 7622c46

File tree

171 files changed

+57331
-10
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

171 files changed

+57331
-10
lines changed

‎CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 2.0.1 (12/02/2025)
2+
3+
* Updated included modules to follow new standard and include other generics
4+
15
## 2.0.0 (02/12/2024)
26

37
BREAKING CHANGES:

‎components/example/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
| Name | Source | Version |
1818
|------|--------|---------|
19+
| <a name="module_kms_s3"></a> [kms\_s3](#module\_kms\_s3) | ../../modules/generic/kms | n/a |
20+
| <a name="module_s3bucket_bestpractice"></a> [s3bucket\_bestpractice](#module\_s3bucket\_bestpractice) | ../../modules/generic/s3bucket | n/a |
1921
| <a name="module_sns_something"></a> [sns\_something](#module\_sns\_something) | ../../modules/generic/sns | n/a |
2022

2123
## Resources

‎components/example/module.kms_s3.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
module "kms_s3" {
2+
source = "../../modules/generic/kms"
3+
4+
aws = local.aws
5+
6+
unique_ids = {
7+
local = "${local.unique_id}-kms-s3"
8+
account = "${local.unique_id_account}-kms-s3"
9+
}
10+
11+
alias = "alias/s3/${local.unique_id}"
12+
create_policies = false
13+
deletion_window = 30
14+
}

‎components/example/module.s3bucket_other.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
module "s3bucket_bestpractice" {
2+
source = "../../modules/generic/s3bucket"
3+
4+
aws = local.aws
5+
6+
unique_ids = {
7+
global = "${local.unique_id_global}-bestpractice"
8+
}
9+
10+
force_destroy = false
11+
12+
kms_key_arn = module.kms_s3.key_arn
13+
}

‎modules/generic/cognito/README.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
## Requirements
3+
4+
No requirements.
5+
6+
## Providers
7+
8+
| Name | Version |
9+
|------|---------|
10+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.85.0 |
11+
12+
## Modules
13+
14+
No modules.
15+
16+
## Resources
17+
18+
| Name | Type |
19+
|------|------|
20+
| [aws_cognito_identity_provider.saml](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_identity_provider) | resource |
21+
| [aws_cognito_user_pool.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool) | resource |
22+
| [aws_cognito_user_pool_client.cognito](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_client) | resource |
23+
| [aws_cognito_user_pool_client.saml](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_client) | resource |
24+
| [aws_cognito_user_pool_domain.custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_domain) | resource |
25+
| [aws_cognito_user_pool_domain.prefix](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_domain) | resource |
26+
| [aws_cognito_user_pool_ui_customization.saml](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool_ui_customization) | resource |
27+
| [aws_iam_role.cognito_user_pool_sms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
28+
| [aws_iam_role_policy.cognito_user_pool_sms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
29+
| [aws_route53_record.alias_cognito_user_pool_domain_custom](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |
30+
| [aws_iam_policy_document.cognito_user_pool_admin_get_user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
31+
| [aws_iam_policy_document.cognito_user_pool_assumerole](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
32+
| [aws_iam_policy_document.cognito_user_pool_manage](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
33+
| [aws_iam_policy_document.cognito_user_pool_read_create_entities](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
34+
| [aws_iam_policy_document.sns_publish_any](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
35+
36+
## Inputs
37+
38+
| Name | Description | Type | Default | Required |
39+
|------|-------------|------|---------|:--------:|
40+
| <a name="input_access_token_validity"></a> [access\_token\_validity](#input\_access\_token\_validity) | Access Token Validity | <pre>object({<br/> value = optional(number, 480)<br/> units = optional(string, "minutes")<br/> })</pre> | <pre>{<br/> "units": "minutes",<br/> "validity": 480<br/>}</pre> | no |
41+
| <a name="input_allowed_oauth_scopes"></a> [allowed\_oauth\_scopes](#input\_allowed\_oauth\_scopes) | Allowed OAuth Scopes for Cognito | `list(string)` | <pre>[<br/> "openid",<br/> "email",<br/> "profile"<br/>]</pre> | no |
42+
| <a name="input_app_fqdn"></a> [app\_fqdn](#input\_app\_fqdn) | Fully Qualified Domain Name for the App protected by Cognito | `string` | n/a | yes |
43+
| <a name="input_aws"></a> [aws](#input\_aws) | n/a | <pre>object({<br/> account_id = string<br/> default_tags = optional(map(string), {})<br/> partition = optional(string, "aws")<br/> region = string<br/> url_suffix = optional(string, "amazonaws.com")<br/> })</pre> | n/a | yes |
44+
| <a name="input_callback_urls"></a> [callback\_urls](#input\_callback\_urls) | Callback URLs for Cognito | `list(string)` | `[]` | no |
45+
| <a name="input_custom_domain"></a> [custom\_domain](#input\_custom\_domain) | Optional FQDN & Route53 Public Hosted Zone ID for a custom Cognito User Pool Domain | <pre>object({<br/> cloudfront_acm_certificate_arn = string<br/> fqdn = string<br/> route53_public_hosted_zone_id = string<br/> })</pre> | `null` | no |
46+
| <a name="input_explicit_auth_flows"></a> [explicit\_auth\_flows](#input\_explicit\_auth\_flows) | Explicit Auth Flows for Cognito | `list(string)` | <pre>[<br/> "ALLOW_USER_PASSWORD_AUTH",<br/> "ALLOW_USER_SRP_AUTH",<br/> "ALLOW_REFRESH_TOKEN_AUTH"<br/>]</pre> | no |
47+
| <a name="input_logout_urls"></a> [logout\_urls](#input\_logout\_urls) | Logout URLs for Cognito if logout\_urls\_are\_callback\_urls is false | `list(string)` | `[]` | no |
48+
| <a name="input_logout_urls_are_callback_urls"></a> [logout\_urls\_are\_callback\_urls](#input\_logout\_urls\_are\_callback\_urls) | Whether the Logout URLs are the same as the Callback URLs | `bool` | `true` | no |
49+
| <a name="input_module_parents"></a> [module\_parents](#input\_module\_parents) | List of parent module names | `list(string)` | `[]` | no |
50+
| <a name="input_saml_idp"></a> [saml\_idp](#input\_saml\_idp) | n/a | <pre>object({<br/> sso_metadata = object({<br/> url = optional(string, null) # "https://login.microsoftonline.com/<tenant_id>/federationmetadata/2007-06/federationmetadata.xml?appid=<app_id>"<br/> content = optional(string, null) # "<xml>...</xml>"<br/> })<br/><br/> ui_customisation = object({<br/> css = optional(string, ".label-customizable {font-weight: 400;}")<br/><br/> image = optional(object({<br/> base64 = optional(string, null)<br/> file = optional(string, null)<br/> }), null)<br/><br/> name = optional(string, null)<br/> })<br/> })</pre> | `null` | no |
51+
| <a name="input_unique_ids"></a> [unique\_ids](#input\_unique\_ids) | n/a | <pre>object({<br/> # All marked as optional for consistency of code.<br/> # Whether each is optional depends on the module implementation.<br/> local = optional(string, null)<br/> account = optional(string, null)<br/> global = optional(string, null)<br/> })</pre> | n/a | yes |
52+
| <a name="input_user_pool_domain_prefix"></a> [user\_pool\_domain\_prefix](#input\_user\_pool\_domain\_prefix) | Cognito User Pool Domain Prefix if not using a custom domain. Defaults to local.unique\_id | `string` | `null` | no |
53+
54+
## Outputs
55+
56+
| Name | Description |
57+
|------|-------------|
58+
| <a name="output_saml_parameters"></a> [saml\_parameters](#output\_saml\_parameters) | SAML Parameters |
59+
| <a name="output_user_pool"></a> [user\_pool](#output\_user\_pool) | n/a |
60+
| <a name="output_user_pool_client"></a> [user\_pool\_client](#output\_user\_pool\_client) | Client User Pool Client Secret |
61+
<!-- END_TF_DOCS -->

‎modules/generic/cognito/aws_cognito_identity_provider.saml.tf

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
resource "aws_cognito_identity_provider" "saml" {
2+
count = local.saml_idp ? 1 : 0
3+
4+
user_pool_id = aws_cognito_user_pool.main.id
5+
6+
provider_name = local.identity_provider_name
7+
provider_type = "SAML"
8+
9+
attribute_mapping = {
10+
email = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
11+
name = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
12+
}
13+
14+
provider_details = {
15+
MetadataFile = var.saml_idp["sso_metadata"]["content"]
16+
MetadataURL = var.saml_idp["sso_metadata"]["url"]
17+
}
18+
19+
# ActiveEncryptionCertificate, SLORedirectBindingURI and SSORedirectBindingURI are only populated from MetadataURL
20+
lifecycle {
21+
ignore_changes = [
22+
provider_details["ActiveEncryptionCertificate"],
23+
provider_details["SLORedirectBindingURI"],
24+
provider_details["SSORedirectBindingURI"],
25+
]
26+
}
27+
}

‎modules/generic/cognito/aws_cognito_user_pool.main.tf

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
resource "aws_cognito_user_pool" "main" {
2+
name = local.unique_id
3+
4+
account_recovery_setting {
5+
recovery_mechanism {
6+
name = "verified_phone_number"
7+
priority = 1
8+
}
9+
10+
recovery_mechanism {
11+
name = "verified_email"
12+
priority = 2
13+
}
14+
}
15+
16+
admin_create_user_config {
17+
allow_admin_create_user_only = true
18+
}
19+
20+
auto_verified_attributes = [
21+
"email",
22+
]
23+
24+
mfa_configuration = "OPTIONAL"
25+
26+
schema {
27+
attribute_data_type = "String"
28+
mutable = true
29+
name = "email"
30+
required = true
31+
32+
string_attribute_constraints {
33+
min_length = 0
34+
max_length = 2048
35+
}
36+
}
37+
38+
sms_configuration {
39+
external_id = "${local.unique_id}-user-pool"
40+
sns_caller_arn = aws_iam_role.cognito_user_pool_sms.arn
41+
}
42+
43+
username_attributes = [
44+
"email",
45+
]
46+
47+
user_pool_add_ons {
48+
advanced_security_mode = "ENFORCED"
49+
}
50+
51+
verification_message_template {
52+
default_email_option = "CONFIRM_WITH_CODE"
53+
email_message = "The verification code to your new account is {####}"
54+
email_subject = "Verify your new account"
55+
sms_message = "The verification code to your new account is {####}"
56+
}
57+
58+
tags = local.default_tags
59+
}

‎modules/generic/cognito/aws_cognito_user_pool_client.cognito.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
resource "aws_cognito_user_pool_client" "cognito" {
2+
count = local.saml_idp ? 0 : 1
3+
4+
name = "${local.unique_id}-cognito"
5+
6+
user_pool_id = aws_cognito_user_pool.main.id
7+
8+
access_token_validity = var.access_token_validity["value"]
9+
10+
token_validity_units {
11+
access_token = var.access_token_validity["units"]
12+
}
13+
14+
allowed_oauth_flows = [
15+
"code",
16+
]
17+
18+
allowed_oauth_flows_user_pool_client = true
19+
allowed_oauth_scopes = var.allowed_oauth_scopes
20+
callback_urls = local.user_pool_client_callback_urls
21+
explicit_auth_flows = var.explicit_auth_flows
22+
generate_secret = true
23+
logout_urls = local.user_pool_client_logout_urls
24+
25+
supported_identity_providers = [
26+
"COGNITO",
27+
]
28+
}

‎modules/generic/cognito/aws_cognito_user_pool_client.saml.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
resource "aws_cognito_user_pool_client" "saml" {
2+
count = local.saml_idp ? 1 : 0
3+
4+
name = "${local.unique_id}-saml"
5+
6+
user_pool_id = aws_cognito_user_pool.main.id
7+
8+
access_token_validity = var.access_token_validity["value"]
9+
10+
token_validity_units {
11+
access_token = var.access_token_validity["units"]
12+
}
13+
14+
allowed_oauth_flows = [
15+
"code",
16+
"implicit",
17+
]
18+
19+
allowed_oauth_flows_user_pool_client = true
20+
allowed_oauth_scopes = var.allowed_oauth_scopes
21+
callback_urls = local.user_pool_client_callback_urls
22+
explicit_auth_flows = var.explicit_auth_flows
23+
generate_secret = true
24+
logout_urls = local.user_pool_client_logout_urls
25+
26+
supported_identity_providers = [
27+
aws_cognito_identity_provider.saml[0].provider_name,
28+
]
29+
}

‎modules/generic/cognito/aws_cognito_user_pool_domain.custom.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "aws_cognito_user_pool_domain" "custom" {
2+
count = local.custom_domain ? 1 : 0
3+
4+
certificate_arn = var.custom_domain["cloudfront_acm_certificate_arn"]
5+
domain = local.user_pool_domain
6+
user_pool_id = aws_cognito_user_pool.main.id
7+
}

0 commit comments

Comments
 (0)