How to set a dynamic RoleMappings key for a IndentityPoolRoleAttachment in CloudFormation

user_1238831 0
Viewed 849

I am building a stack to initialize a Cognito installation. As part of this I have setup user groups with associated roles. I need to set the Choose role from token option, allowing identities to use roles from the group(s) to which they are assigned.

This is done through the RoleMappings object in the IndentityPoolRoleAttachment object. This mappings object is a string -> object map, where the string represents the identity provider. In my case, this is:

cognito-idp.${some-region}.amazonaws.com/${some-userpool-id}:${some-pool-client-id}

Obviously, this needs to be dynamically built based on values in the stack, but I havent found a way to do this in a syntactically correct manner. Using Ref and Fn::Sub both result in syntactical errors. I have tried in both yaml and json syntax.

Am I missing something obvious?

amazon-cloudformation amazon-cognito amazon-web-services json
1 Answers

Got stuck on this problem recently and I visited the thread from @AkkarinZA's comment.

In that thread, @mikef's response worked for me. We can use cognitoProvider key.

RoleMappings:
     cognitoProvider:
       IdentityProvider: 
        Fn::Join:
          - ''
          - - "cognito-idp.${self:provider.region}.amazonaws.com/"
            - !Ref CustomerUserPool
            - ':'
            - !Ref CustomerUserPoolClient
       AmbiguousRoleResolution: Deny
       Type: Rules
       RulesConfiguration:
          Rules:
            - Claim: cognito:groups
              MatchType: Contains
              Value: "clients"
              RoleARN:
                { Fn::GetAtt: [UserIdentityPoolClientRole, Arn] }
user_35484680
Related