feat: Add User Migration trigger option to Cognito

aws-amplify · Nov 16, 2023 · 26e4ff4 · 26e4ff4
1 parent 7fbf29f
commit 26e4ff4
Show file tree

Hide file tree

Showing 7 changed files with 235 additions and 0 deletions.
diff --git a/...egory-auth/provider-utils/awscloudformation/triggers/UserMigration/UserMigration.map.json b/...egory-auth/provider-utils/awscloudformation/triggers/UserMigration/UserMigration.map.json
@@ -0,0 +1,2 @@
+{
+}
diff --git a/.../awscloudformation/triggers/UserMigration/cloudformation-templates/UserMigration.json.ejs b/.../awscloudformation/triggers/UserMigration/cloudformation-templates/UserMigration.json.ejs
@@ -0,0 +1,204 @@
+{
+    "AWSTemplateFormatVersion": "2010-09-09",
+    "Description": "Lambda resource stack creation using Amplify CLI",
+    "Parameters": {
+        "modules": {
+            "Type": "String",
+            "Default": "",
+            "Description": "Comma-delimited list of modules to be executed by a lambda trigger. Sent to resource as an env variable."
+        },
+        "resourceName": {
+            "Type": "String",
+            "Default": ""
+        },
+        "trigger": {
+            "Type": "String",
+            "Default": "true"
+        },
+        "functionName": {
+            "Type": "String",
+            "Default": ""
+        },
+        "roleName": {
+            "Type": "String",
+            "Default": ""
+        },
+        "parentResource": {
+            "Type": "String",
+            "Default": ""
+        },
+        "parentStack": {
+      "Type": "String",
+      "Default": ""
+    },
+        "env": {
+            "Type": "String"
+        }<%if (props.dependsOn && props.dependsOn.length > 0) { %>,<% } %>
+    <% if (props.dependsOn) { %>
+    <% for(var i=0; i < props.dependsOn.length; i++) { %>
+    <% for(var j=0; j < props.dependsOn[i].attributes.length; j++) { %>
+        "<%= props.dependsOn[i].category %><%= props.dependsOn[i].resourceName %><%= props.dependsOn[i].attributes[j] %>": {
+            "Type": "String",
+            "Default": "<%= props.dependsOn[i].category %><%= props.dependsOn[i].resourceName %><%= props.dependsOn[i].attributes[j] %>"
+            }<%if (i !== props.dependsOn.length - 1 || j !== props.dependsOn[i].attributes.length - 1) { %>,<% } %>
+        <% } %>
+        <% } %>
+    <% } %>
+    },
+    "Conditions": {
+        "ShouldNotCreateEnvResources": {
+            "Fn::Equals": [
+                {
+                    "Ref": "env"
+                },
+                "NONE"
+            ]
+        }
+    },
+    "Resources": {
+        "LambdaFunction": {
+          "Type": "AWS::Lambda::Function",
+          "Metadata": {
+            "aws:asset:path": "./src",
+            "aws:asset:property": "Code"
+          },
+          "Properties": {
+            "Handler": "index.handler",
+            "FunctionName": {
+                "Fn::If": [
+                    "ShouldNotCreateEnvResources",
+                    "<%= props.functionName %>",
+                    {
+
+                        "Fn::Join": [
+                            "",
+                            [
+                                "<%= props.functionName %>",
+                                "-",
+                                {
+                                    "Ref": "env"
+                                }
+                            ]
+                        ]
+                    }
+                ]
+            },
+            "Environment": {
+                "Variables" : {
+                    "ENV": {
+                        "Ref": "env"
+                    },
+                    "MODULES": {
+                        "Ref": "modules"
+                    },
+                    "REGION": {
+                        "Ref": "AWS::Region"
+                    }
+                }
+            },
+            "Role": { "Fn::GetAtt" : ["LambdaExecutionRole", "Arn"] },
+            "Runtime": "nodejs18.x",
+            "Timeout": 25
+          }
+        },
+        "LambdaExecutionRole": {
+            "Type": "AWS::IAM::Role",
+            "Properties": {
+                "RoleName": {
+                    "Fn::If": [
+                        "ShouldNotCreateEnvResources",
+                        "<%=props.roleName %>",
+                        {
+
+                            "Fn::Join": [
+                                "",
+                                [
+                                    "<%=props.roleName %>",
+                                    "-",
+                                    {
+                                        "Ref": "env"
+                                    }
+                                ]
+                            ]
+                        }
+                    ]
+                },
+                "AssumeRolePolicyDocument": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Principal": {
+                                "Service": [
+                                    "lambda.amazonaws.com"
+                                ]
+                            },
+                            "Action": [
+                                "sts:AssumeRole"
+                            ]
+                        }
+                    ]
+                }
+            }
+        }
+        ,"lambdaexecutionpolicy": {
+            "DependsOn": ["LambdaExecutionRole"],
+            "Type": "AWS::IAM::Policy",
+            "Properties": {
+                "PolicyName": "lambda-execution-policy",
+                "Roles": [{ "Ref": "LambdaExecutionRole" }],
+                "PolicyDocument": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Action":["logs:CreateLogGroup",
+                            "logs:CreateLogStream",
+                            "logs:PutLogEvents"],
+                            "Resource": { "Fn::Sub" : [ "arn:aws:logs:${region}:${account}:log-group:/aws/lambda/${lambda}:log-stream:*", { "region": {"Ref": "AWS::Region"},  "account": {"Ref": "AWS::AccountId"}, "lambda": {"Ref": "LambdaFunction"}} ]}
+                        }
+                    ]
+                }
+            }
+        }<% if (props.categoryPolicies && props.categoryPolicies.length > 0 ) { %>
+        ,"AmplifyResourcesPolicy": {
+            "DependsOn": ["LambdaExecutionRole"],
+            "Type": "AWS::IAM::Policy",
+            "Properties": {
+                "PolicyName": "amplify-lambda-execution-policy",
+                "Roles": [{ "Ref": "LambdaExecutionRole" }],
+                "PolicyDocument": {
+                    "Version": "2012-10-17",
+                    "Statement": <%- JSON.stringify(props.categoryPolicies) %>
+                }
+            }
+        }
+        <% } %>
+    },
+    "Outputs": {
+        "Name": {
+            "Value": {
+                "Ref": "LambdaFunction"
+            }
+        },
+        "Arn": {
+            "Value": {"Fn::GetAtt": ["LambdaFunction", "Arn"]}
+        },
+          "LambdaExecutionRole": {
+              "Value": {
+                  "Ref": "LambdaExecutionRole"
+              }
+          },
+          "LambdaExecutionRoleArn": {
+              "Value": {
+                  "Fn::GetAtt": ["LambdaExecutionRole", "Arn"]
+              }
+          },
+        "Region": {
+            "Value": {
+                "Ref": "AWS::Region"
+            }
+        }
+    }
+  }
+
diff --git a/.../provider-utils/awscloudformation/triggers/UserMigration/function-template-dir/event.json b/.../provider-utils/awscloudformation/triggers/UserMigration/function-template-dir/event.json
@@ -0,0 +1,5 @@
+{
+  "key1": "value1",
+  "key2": "value2",
+  "key3": "value3"
+}
diff --git a/...der-utils/awscloudformation/triggers/UserMigration/function-template-dir/package.json.ejs b/...der-utils/awscloudformation/triggers/UserMigration/function-template-dir/package.json.ejs
@@ -0,0 +1,13 @@
+{
+  "name": "<%= props.functionName %>",
+  "version": "2.0.0",
+  "description": "Lambda function generated by Amplify",
+  "main": "index.js",
+  "license": "Apache-2.0",
+  "dependencies": {
+    "axios": "latest"
+  },
+  "devDependencies": {
+    "@types/aws-lambda": "^8.10.92"
+  }
+}
diff --git a/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/cognito.map.json b/packages/amplify-category-auth/provider-utils/awscloudformation/triggers/cognito.map.json
@@ -26,5 +26,8 @@
   "PreTokenGeneration": {
     "name": "Pre Token Generation"
   },
+  "UserMigration": {
+    "name": "User Migration"
+  },
   "URL": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html"
 }
diff --git a/...uth/src/provider-utils/awscloudformation/auth-stack-builder/auth-cognito-stack-builder.ts b/...uth/src/provider-utils/awscloudformation/auth-stack-builder/auth-cognito-stack-builder.ts
@@ -26,6 +26,7 @@ const LambdaTriggersKeys = [
   'PreSignup',
   'PreTokenGeneration',
   'VerifyAuthChallengeResponse',
+  'UserMigration'
 ];
 
 const authProvidersList: Record<string, string> = {
@@ -362,6 +363,12 @@ export class AmplifyAuthCognitoStack extends cdk.Stack implements AmplifyAuthCog
               verifyAuthChallengeResponse: cdk.Fn.ref(`function${props.resourceName}${'VerifyAuthChallengeResponse'}Arn`),
             };
           }
+          if (trigger.resourceName.includes('UserMigration')) {
+            this.userPool!.lambdaConfig = {
+              ...this.userPool!.lambdaConfig,
+              userMigration: cdk.Fn.ref(`function${props.resourceName}${'UserMigration'}Arn`),
+            };
+          }
         });
       }
 

diff --git a/...rc/provider-utils/awscloudformation/service-walkthrough-types/cognito-user-input-types.ts b/...rc/provider-utils/awscloudformation/service-walkthrough-types/cognito-user-input-types.ts
@@ -154,6 +154,7 @@ export enum TriggerType {
   PreSignup = 'PreSignUp',
   VerifyAuthChallengeResponse = 'VerifyAuthChallengeResponse',
   PreTokenGeneration = 'PreTokenGeneration',
+  UserMigration = 'UserMigration',
 }
 
 export type AuthTriggerConnection = {