BCSS-23458 TERRAFORM MODULE: COGNITO

infrastructure/modules/cognito/context.tf

@@ -0,0 +1,144 @@
+#
+# ONLY EDIT THIS FILE IN github.com/NHSDigital/screening-terraform-modules-aws/infrastructure/modules/tags
+# All other instances of this file should be a copy of that one
+#
+#
+# Copy this file from https://github.com/NHSDigital/screening-terraform-modules-aws/blob/master/infrastructure/modules/tags/exports/context.tf
+# and then place it in your Terraform module to automatically get
+# tag module standard configuration inputs suitable for passing
+# to other modules.
+#
+# curl -sL https://raw.githubusercontent.com/NHSDigital/screening-terraform-modules-aws/master/infrastructure/modules/tags/exports/context.tf -o context.tf
+#
+# Modules should access the whole context as `module.this.context`
+# to get the input variables with nulls for defaults,
+# for example `context = module.this.context`,
+# and access individual variables as `module.this.<var>`,
+# with final values filled in.
+#
+# For example, when using defaults, `module.this.context.delimiter`
+# will be null, and `module.this.delimiter` will be `-` (hyphen).
+#
+
+module "this" {
+  source = "git::https://github.com/NHSDigital/screening-terraform-modules-aws.git//infrastructure/modules/tags?ref=v2.6.0"
+
+  enabled             = coalesce(var.enabled, lookup(var.context, "enabled", true))
+  service             = coalesce(var.service, lookup(var.context, "service", null))
+  project             = coalesce(var.project, lookup(var.context, "project", null))
+  region              = lookup(var.context, "region", null)
+  environment         = coalesce(var.environment, lookup(var.context, "environment", null))
+  stack               = lookup(var.context, "stack", null)
+  workspace           = lookup(var.context, "workspace", null)
+  name                = coalesce(var.name, lookup(var.context, "name", null))
+  delimiter           = lookup(var.context, "delimiter", null)
+  attributes          = lookup(var.context, "attributes", [])
+  tags                = merge(lookup(var.context, "tags", {}), var.tags)
+  additional_tag_map  = lookup(var.context, "additional_tag_map", {})
+  label_order         = lookup(var.context, "label_order", [])
+  regex_replace_chars = lookup(var.context, "regex_replace_chars", null)
+  id_length_limit     = lookup(var.context, "id_length_limit", null)
+  label_key_case      = lookup(var.context, "label_key_case", null)
+  label_value_case    = lookup(var.context, "label_value_case", null)
+  terraform_source    = coalesce(var.terraform_source, lookup(var.context, "terraform_source", null), path.module)
+  descriptor_formats  = lookup(var.context, "descriptor_formats", {})
+  labels_as_tags      = toset(lookup(var.context, "labels_as_tags", ["unset"]))
+
+  context = var.context
+}
+
+variable "aws_region" {
+  type        = string
+  description = "AWS region used for derived Cognito hosted UI outputs."
+  default     = "eu-west-2"
+
+  validation {
+    condition     = contains(["eu-west-1", "eu-west-2", "us-east-1"], var.aws_region)
+    error_message = "AWS Region must be one of eu-west-1, eu-west-2, us-east-1"
+  }
+}
+
+variable "context" {
+  type = any
+  default = {
+    enabled             = true
+    service             = null
+    project             = null
+    region              = null
+    environment         = null
+    stack               = null
+    workspace           = null
+    name                = null
+    delimiter           = null
+    attributes          = []
+    tags                = {}
+    additional_tag_map  = {}
+    regex_replace_chars = null
+    label_order         = []
+    id_length_limit     = null
+    label_key_case      = null
+    label_value_case    = null
+    terraform_source    = null
+    descriptor_formats  = {}
+    labels_as_tags      = ["unset"]
+  }
+  description = <<-EOT
+    Single object for setting entire context at once.
+    See description of individual variables for details.
+    Leave string and numeric variables as `null` to use default value.
+    Individual variable settings (non-null) override settings in context object,
+    except for attributes, tags, and additional_tag_map, which are merged.
+  EOT
+
+  validation {
+    condition     = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
+    error_message = "Allowed values: `lower`, `title`, `upper`."
+  }
+
+  validation {
+    condition     = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
+    error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
+  }
+}
+
+variable "terraform_source" {
+  type        = string
+  default     = null
+  description = "Source location to record in the Terraform_source tag. Defaults to the caller module path when not set."
+}
+
+variable "enabled" {
+  type        = bool
+  default     = null
+  description = "Set to false to prevent the module from creating any resources."
+}
+
+variable "service" {
+  type        = string
+  default     = null
+  description = "Service identifier used by the shared tags module."
+}
+
+variable "project" {
+  type        = string
+  default     = null
+  description = "Project identifier used by the shared tags module."
+}
+
+variable "environment" {
+  type        = string
+  default     = null
+  description = "Environment identifier used by the shared tags module."
+}
+
+variable "name" {
+  type        = string
+  default     = null
+  description = "Name identifier used by the shared tags module."
+}
+
+variable "tags" {
+  type        = map(string)
+  default     = {}
+  description = "Additional tags merged with any tags supplied through the context object."
+}

infrastructure/modules/cognito/main.tf

@@ -1,110 +1,113 @@
-data "aws_ssm_parameter" "cognito_users" {
-  name = "/${var.name_prefix}/cognito/users"
-}
-
 locals {
-  userdata = jsondecode(nonsensitive(data.aws_ssm_parameter.cognito_users.value))
-}
-
-resource "random_password" "password" {
-  length           = 20
-  special          = true
-  override_special = "!%^*-_+="
-}
-
-resource "aws_secretsmanager_secret" "password" {
-  name                    = "${var.name_prefix}-cognito-user"
-  recovery_window_in_days = var.recovery_window
+  user_pool_name          = coalesce(var.name_prefix != null ? "${var.name_prefix}-users-pool" : null, module.this.id)
+  domain_name             = coalesce(var.domain, var.name_prefix, local.user_pool_name)
+  default_app_client_name = coalesce(var.name_prefix != null ? "${var.name_prefix}-users-client" : null, "${local.user_pool_name}-client")
 
-  dynamic "replica" {
-    for_each = var.secret_replication_regions
-    content {
-      region = replica.value
-    }
+  default_admin_create_user_config = {
+    allow_admin_create_user_only = false
   }
-}
 
-resource "aws_secretsmanager_secret_version" "password" {
-  secret_id = aws_secretsmanager_secret.password.id
-  secret_string = jsonencode({
-    password = random_password.password.result
-  })
-}
-
-# Create user pool
-resource "aws_cognito_user_pool" "cognito_user_pool" {
-  auto_verified_attributes = [
-    "email",
-  ]
+  default_email_configuration = {
+    email_sending_account = "COGNITO_DEFAULT"
+  }
 
-  deletion_protection = var.deletion_protection
-  mfa_configuration   = var.mfa_configuration
-  name                = var.name_prefix
-  username_attributes = []
+  default_password_policy = {
+    minimum_length                   = 8
+    require_lowercase                = false
+    require_numbers                  = false
+    require_symbols                  = false
+    require_uppercase                = false
+    temporary_password_validity_days = 7
+  }
 
-  account_recovery_setting {
-    recovery_mechanism {
+  default_recovery_mechanisms = [
+    {
       name     = "verified_email"
       priority = 1
-    }
-    recovery_mechanism {
+    },
+    {
       name     = "verified_phone_number"
       priority = 2
     }
-  }
+  ]
 
-  admin_create_user_config {
-    allow_admin_create_user_only = false
+  default_username_configuration = {
+    case_sensitive = false
   }
 
-  email_configuration {
-    email_sending_account = "COGNITO_DEFAULT"
+  default_verification_message_template = {
+    default_email_option = "CONFIRM_WITH_CODE"
   }
 
-  password_policy {
-    minimum_length                   = 8
-    require_lowercase                = false
-    require_numbers                  = false
-    require_symbols                  = false
-    require_uppercase                = false
-    temporary_password_validity_days = 7
-  }
-  dynamic "schema" {
-    for_each = var.attribute_names
-    content {
+  default_string_schemas = [
+    for attribute_name in var.attribute_names : {
       attribute_data_type      = "String"
       developer_only_attribute = false
       mutable                  = true
-      name                     = schema.value
+      name                     = attribute_name
       required                 = false
-
-      string_attribute_constraints {
-        max_length = "256"
+      string_attribute_constraints = {
         min_length = "1"
+        max_length = "256"
       }
     }
-  }
-  username_configuration {
-    case_sensitive = false
-  }
+  ]
 
-  verification_message_template {
-    default_email_option = "CONFIRM_WITH_CODE"
-  }
+  cognito_clients = [
+    for client in var.app_clients : {
+      name                                          = try(client.name, local.default_app_client_name)
+      callback_urls                                 = client.callback_urls
+      logout_urls                                   = client.logout_urls
+      default_redirect_uri                          = try(client.default_redirect_uri, null)
+      generate_secret                               = try(client.generate_secret, true)
+      auth_session_validity                         = try(client.auth_session_validity, 3)
+      allowed_oauth_flows_user_pool_client          = true
+      allowed_oauth_flows                           = ["code"]
+      allowed_oauth_scopes                          = ["email", "openid", "profile", "aws.cognito.signin.user.admin"]
+      explicit_auth_flows                           = ["ALLOW_REFRESH_TOKEN_AUTH", "ALLOW_USER_SRP_AUTH", "ALLOW_USER_PASSWORD_AUTH"]
+      supported_identity_providers                  = ["COGNITO"]
+      enable_propagate_additional_user_context_data = try(client.enable_propagate_additional_user_context_data, false)
+      access_token_validity                         = 60
+      id_token_validity                             = try(client.id_token_validity, null)
+      refresh_token_validity                        = try(client.refresh_token_validity, null)
+      token_validity_units                          = { access_token = "minutes", id_token = "minutes", refresh_token = "days" }
+      prevent_user_existence_errors                 = try(client.prevent_user_existence_errors, null)
+      enable_token_revocation                       = try(client.enable_token_revocation, true)
+    }
+  ]
 }
 
-
-resource "aws_cognito_user_pool_domain" "main" {
-  domain       = var.name_prefix
-  user_pool_id = aws_cognito_user_pool.cognito_user_pool.id
+module "cognito" {
+  source  = "lgallard/cognito-user-pool/aws"
+  version = "4.0.2"
+
+  enabled = module.this.enabled && var.create
+
+  user_pool_name           = local.user_pool_name
+  domain                   = local.domain_name
+  deletion_protection      = var.deletion_protection
+  auto_verified_attributes = ["email"]
+  mfa_configuration        = var.mfa_configuration
+
+  admin_create_user_config      = local.default_admin_create_user_config
+  email_configuration           = local.default_email_configuration
+  password_policy               = local.default_password_policy
+  recovery_mechanisms           = local.default_recovery_mechanisms
+  string_schemas                = local.default_string_schemas
+  username_configuration        = local.default_username_configuration
+  verification_message_template = local.default_verification_message_template
+  clients                       = local.cognito_clients
+  ignore_schema_changes         = true
+
+  tags = module.this.tags
 }
 
-resource "aws_cognito_user" "cognito_user_creation" {
-  for_each = { for inst in local.userdata : inst.uuid => inst }
+resource "aws_cognito_user" "bootstrap_users" {
+  for_each = module.this.enabled && var.create ? { for user in var.bootstrap_users : user.uuid => user } : {}
 
-  user_pool_id   = aws_cognito_user_pool.cognito_user_pool.id
-  username       = each.value.bss_username
-  password       = random_password.password.result
+  user_pool_id   = module.cognito.id
+  username       = each.value.bcss_username
+  password       = coalesce(try(each.value.user_password, null), var.user_password)
   message_action = var.message_action
 
   attributes = {
@@ -114,7 +117,7 @@ resource "aws_cognito_user" "cognito_user_creation" {
     email_verified    = true
     idassurancelevel  = each.value.id_assurance_level
     nhsid_nrbac_roles = each.value.rbac_role
-    bss_username      = each.value.bss_username
+    bcss_username     = each.value.bcss_username
     sid               = each.value.uuid
     uid               = each.value.uuid
   }