│ Error: error creating Cognito User Pool Client (portals-dev): InvalidParameterException: The provider Salesforce does not exist for User Pool YYYYYYY.
│
│   with module.cognito.aws_cognito_user_pool_client.client[0],
│   on .terraform/modules/cognito/client.tf line 1, in resource "aws_cognito_user_pool_client" "client":
│    1: resource "aws_cognito_user_pool_client" "client" {
│

from_email_address  = lookup(email_configuration.value, "from_email_address")

Terraform will perform the following actions:

  # aws_cognito_identity_provider.identity_provider[0] will be updated in-place
  ~ resource "aws_cognito_identity_provider" "identity_provider" {
        id                = "eu-west-1_w5o31Ioby:auth0-dev"
      ~ provider_details  = (sensitive value)
        # (5 unchanged attributes hidden)
    }

  # aws_cognito_identity_provider.identity_provider[1] will be updated in-place
  ~ resource "aws_cognito_identity_provider" "identity_provider" {
        id                = "eu-west-1_w5o31Ioby:pingid-dev"
      ~ provider_details  = (sensitive value)
        # (5 unchanged attributes hidden)
    }

  # aws_cognito_user_pool.pool[0] will be updated in-place
  ~ resource "aws_cognito_user_pool" "pool" {
        id                         = "eu-west-1_w5o31Ioby"
        name                       = "confluence-dev"
        tags                       = {
            "Contact"     = "Dennis Hoppe"
            "Environment" = "dev"
            "Owner"       = "SICO"
            "Project"     = "Atlassian"
        }
        # (13 unchanged attributes hidden)

      ~ account_recovery_setting {
          - recovery_mechanism {
              - name     = "verified_email" -> null
              - priority = 1 -> null
            }
          - recovery_mechanism {
              - name     = "verified_phone_number" -> null
              - priority = 2 -> null
            }
        }

        # (16 unchanged blocks hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.
aws_cognito_user_pool.pool[0]: Modifying... [id=eu-west-1_w5o31Ioby]
╷
│ Error: updating Cognito User pool (eu-west-1_w5o31Ioby): InvalidParameter: 1 validation error(s) found.
│ - minimum field size of 1, UpdateUserPoolInput.AccountRecoverySetting.RecoveryMechanisms.
│
│
│   with aws_cognito_user_pool.pool[0],
│   on main.tf line 1, in resource "aws_cognito_user_pool" "pool":
│    1: resource "aws_cognito_user_pool" "pool" {
│
╵
ERRO[0070] Terraform invocation failed in /Users/dhoppe/Customers/_REDACTED_/terragrunt-aws-atlassian/stacks/dev/eu-west-1/confluence/cognito/.terragrunt-cache/xHv5-BJMHVQytE_vi51vNgSP5cU/c_2QZ4BzEhEbpfllRPzfL-I6xic  prefix=[/Users/dhoppe/Customers/_REDACTED_/terragrunt-aws-atlassian/stacks/dev/eu-west-1/confluence/cognito]
ERRO[0070] Module /Users/dhoppe/Customers/_REDACTED_/terragrunt-aws-atlassian/stacks/dev/eu-west-1/confluence/cognito has finished with an error: 1 error occurred:
	* exit status 1
  prefix=[/Users/dhoppe/Customers/_REDACTED_/terragrunt-aws-atlassian/stacks/dev/eu-west-1/confluence/cognito]
ERRO[0070] 1 error occurred:
	* exit status 1

  recovery_mechanisms = [
    {
      name     = "verified_email"
      priority = 1
    },
    {
      name     = "verified_phone_number"
      priority = 2
    }
  ]

  - account_recovery_setting {
    }

 # module.cognito_user_pool.aws_cognito_user_pool.pool[0] will be updated in-place
  ~ resource "aws_cognito_user_pool" "pool" {
     ...
     ...
     + lambda_config {
          + custom_email_sender {
              + lambda_arn     = (known after apply)
              + lambda_version = (known after apply)
            }

          + custom_sms_sender {
              + lambda_arn     = (known after apply)
              + lambda_version = (known after apply)
            }
        }

module "user_pool" {
  source  = "lgallard/cognito-user-pool/aws"
  version = "0.20.1"  # v0.21 fails with: attributes_require_verification_before_update = lookup(user_attribute_update_settings.value,...

  user_pool_name = var.name
  domain         = local.stripped_domain_name
  admin_create_user_config_allow_admin_create_user_only = true
  username_attributes                                   = ["email"]

  email_verification_message = var.email_verification_message

  password_policy = {
    minimum_length                   = 8
    require_lowercase                = false
    require_numbers                  = true
    require_symbols                  = false
    require_uppercase                = true
    temporary_password_validity_days = 1
  }


  email_configuration = {
    email_sending_account  = "DEVELOPER"
    from_email_address     = "noreply@${var.email_domain}"
    source_arn             = var.ses_domain_identity
  }

  recovery_mechanisms = [
    {
      name     = "verified_email"
      priority = 1
    }
  ]

  clients = [
    {
      allowed_oauth_flows                  = ["code"]
      allowed_oauth_flows_user_pool_client = true
      allowed_oauth_scopes                 = ["email", "openid"]
      callback_urls                        = ["https://${var.domain_name}/oauth2/callback"]
      default_redirect_uri                 = "https://${var.domain_name}/oauth2/callback"
      explicit_auth_flows                  = ["ALLOW_USER_SRP_AUTH", "ALLOW_REFRESH_TOKEN_AUTH"]
      generate_secret                      = true
      logout_urls                          = ["https://${var.domain_name}", "https://${var.domain_name}/oauth2/sign_out"]
      name                                 = local.client_name
      read_attributes                      = ["email"]
      supported_identity_providers         = ["COGNITO"]
      write_attributes                     = []
      access_token_validity                = 1
      id_token_validity                    = 1
      refresh_token_validity               = 1
      token_validity_units = {
        access_token  = "hours"
        id_token      = "hours"
        refresh_token = "days"
      }
    }
  ]
}

    user_pool_name = "name"

    alias_attributes         = ["email"]
    auto_verified_attributes = ["email"]

    admin_create_user_config = {
      allow_admin_create_user_only = false
    }
  
  string_schemas = [
    {
      attribute_data_type      = "String"
      developer_only_attribute = false
      mutable                  = false
      name                     = "email"
      required                 = true

      string_attribute_constraints = {
        min_length = 5
        max_length = 50
      }
    }
  ]
  
  # sms_configuration = {}
  email_configuration = {
    from_email_address     = "[email protected]"
    email_sending_account  = "DEVELOPER"
    source_arn             = "arn:aws:ses:us-east-1:${local.account_vars.locals.account_id}:identity/[email protected]"
  }

  lambda_config = {
    custom_message         = dependency.lambda.outputs.lambda_function_arn
  }
  
  password_policy = {
    minimum_length    = 8
    require_lowercase = true
    require_numbers   = true
    require_symbols   = true
    require_uppercase = true
  }

  clients = [
    {
      name = "name"
      prevent_user_existence_errors        = "ENABLED"
      access_token_validity                = 1
      id_token_validity                    = 1
      refresh_token_validity               = 30
      token_validity_units = {
        access_token  = "hours"
        id_token      = "hours"
        refresh_token = "days"
      }
      
    }, 
    
    }
  ]

  recovery_mechanisms = [
    {
      name     = "verified_email"
      priority = 1
    }
  ]

╷
│ Error: creating Cognito User Pool: AccessDeniedException: User: arn:aws:iam::XXXXXXXXXXXXX:user/cc/admin/guy is not authorized to perform: cognito-idp:CreateUserPool on resource: * because no identity-based policy allows the cognito-idp:CreateUserPool action
│       status code: 400, request id: d4e241ba-3bf7-4b17-9888-4233d7f99ca4
│ 
│   with module.cognito-hash.aws_cognito_user_pool.pool[0],
│   on ../../terraform-aws-cognito-user-pool/main.tf line 1, in resource "aws_cognito_user_pool" "pool":
│    1: resource "aws_cognito_user_pool" "pool" {
│ 
╵```

  # module.user_pool.aws_cognito_identity_provider.identity_provider[0] will be updated in-place
  ~ resource "aws_cognito_identity_provider" "identity_provider" {
      ~ attribute_mapping = {
          - "username" = "sub" -> null
            # (2 unchanged elements hidden)
        }
        id                = "us-west-2_xxxxxxx:Google"
      ~ provider_details  = {
          - "attributes_url"                = "https://people.googleapis.com/v1/people/me?personFields=" -> null
          - "attributes_url_add_attributes" = "true" -> null
          - "authorize_url"                 = "https://accounts.google.com/o/oauth2/v2/auth" -> null
          - "oidc_issuer"                   = "https://accounts.google.com" -> null
          - "token_request_method"          = "POST" -> null
          - "token_url"                     = "https://www.googleapis.com/oauth2/v4/token" -> null
            # (3 unchanged elements hidden)
        }
        # (4 unchanged attributes hidden)
    }

resource "aws_cognito_identity_provider" "identity_provider" {
  count         = 1
  user_pool_id  = "us-west-2_XXXXXXX"
  provider_name = "Google"
  provider_type = "Google"

  # Optional arguments
  attribute_mapping = {
    email          = "email"
    email_verified = "email_verified"
    username       = "sub"
  }
  idp_identifiers  = []
  provider_details = {
    authorize_scopes = "profile email"
    client_id        = "xxxxxxxxx-xxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com"
    client_secret    = "111"
  }
}

module "cognito_user_pool" {
  source  = "lgallard/cognito-user-pool/aws"
  ...
  resource_servers = [
    {
      identifier = "https://foo.bar"
      scope = [
        {
          scope_name = "api"
        }
      ]
    }
  ]
  clients = [
  {
    allowed_oauth_scopes = ["openid", "profile", "https://foo.bar/api"]
  }
}

resource "aws_cognito_user_pool_client" "client" {
  ...
  depends_on = [ aws_cognito_resource_server.resource ]
}

module "cognito_user_pool" {
  source  = "lgallard/cognito-user-pool/aws"
  version = "0.20.1"

  user_pool_name      = "Default"
  username_attributes = ["email"]
 
   .... 
   string_schemas = [
     {
      attribute_data_type      = "String"
      developer_only_attribute = false
      mutable                  = true
      name                     = "groups"
      required                 = false

      string_attribute_constraints = {}
     },
     {
      attribute_data_type      = "String"
      developer_only_attribute = false
      mutable                  = true
      name                     = "email"
      required                 = true

      string_attribute_constraints = {
        max_length = "2048"
        min_length = "0"
      }
    }
 ]
}

  # module.cognito_user_pool.aws_cognito_user_pool.pool[0] will be updated in-place
  ~ resource "aws_cognito_user_pool" "pool" {
        id                         = "us-east-1_ABCDE1234"
        name                       = "Default"
        tags                       = {
            "Terraform"   = "true"
        }
        # (14 unchanged attributes hidden)

      - schema {
          - attribute_data_type      = "String" -> null
          - developer_only_attribute = false -> null
          - mutable                  = true -> null
          - name                     = "groups" -> null
          - required                 = false -> null

          - string_attribute_constraints {}
        }
      + schema {
          + attribute_data_type      = "String"
          + developer_only_attribute = false
          + mutable                  = true
          + name                     = "groups"
          + required                 = false
        }
      + schema {
        }

        # (11 unchanged blocks hidden)
    }

  string_attribute_constraints = {
    min_length = 3
    max_length = 50
  }
},

### Due to the above statement assuming that both attributes are false, it is set to both attributes as null. 
### So the option was forced to be set as a "Don’t remember" Option.
### However, the following configuration should be "Always remember", Allow users to bypass MFA for trusted devices "NO"
device_configuration = {
    challenge_required_on_new_device      = false
    device_only_remembered_on_user_prompt = false
}


### These are the following combinations for device configuration:
### 1) "Don’t remember" Option
device_configuration = {
    challenge_required_on_new_device      = null
    device_only_remembered_on_user_prompt = null
}

### 2) "User opt-in", Allows users to bypass MFA for trusted devices "YES"  Option
device_configuration = {
    challenge_required_on_new_device      = true
    device_only_remembered_on_user_prompt = true
}

### 3) "User opt-in", Allows users to bypass MFA for trusted devices "NO"  Option
device_configuration = {
    challenge_required_on_new_device      = false
    device_only_remembered_on_user_prompt = true
}

### 4) "Always remember", Allow users to bypass MFA for trusted devices "NO"  Option
device_configuration = {
    challenge_required_on_new_device      = false
    device_only_remembered_on_user_prompt = false
}

### 5) "Always remember", Allow users to bypass MFA for trusted devices "YES"  Option
device_configuration = {
    challenge_required_on_new_device      = true
    device_only_remembered_on_user_prompt = false
}

### Modify "main.tf" file
### Commented the Line 40 device_configuration
# device_configuration
# dynamic "device_configuration" {
#   for_each = local.device_configuration
#   content {
#     challenge_required_on_new_device      = lookup(device_configuration.value, "challenge_required_on_new_device")
#     device_only_remembered_on_user_prompt = lookup(device_configuration.value, "device_only_remembered_on_user_prompt")
#   }
# }

### Replaced with the following as Hotfix
device_configuration {
    challenge_required_on_new_device      = try(var.device_configuration.challenge_required_on_new_device, null)
    device_only_remembered_on_user_prompt = try(var.device_configuration.device_only_remembered_on_user_prompt, null)
}

variable "client_access_token_validity" {
  description = "Time limit, between 5 minutes and 1 day, after which the access token is no longer valid and cannot be used. This value will be overridden if you have entered a value in `token_validity_units`."
  type        = number
  default     = 60
}

variable "client_id_token_validity" {
  description = "Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and cannot be used. Must be between 5 minutes and 1 day. Cannot be greater than refresh token expiration. This value will be overridden if you have entered a value in `token_validity_units`."
  type        = number
  default     = 60
}

variable "client_token_validity_units" {
  description = "Configuration block for units in which the validity times are represented in. Valid values for the following arguments are: `seconds`, `minutes`, `hours` or `days`."
  type        = any
  default = {
    access_token  = "hours"
    id_token      = "hours"
    refresh_token = "days"
  }

}

  clients = [
    {
      allowed_oauth_flows                  = []
      allowed_oauth_flows_user_pool_client = false
      allowed_oauth_scopes                 = []
      callback_urls                        = ["https://portal-test-oregon/callback"]
      default_redirect_uri                 = "https://portal-test-oregon/callback"
      explicit_auth_flows                  = ["ALLOW_ADMIN_USER_PASSWORD_AUTH", "ALLOW_CUSTOM_AUTH", "ALLOW_USER_PASSWORD_AUTH", "ALLOW_USER_SRP_AUTH", "ALLOW_REFRESH_TOKEN_AUTH"]
      generate_secret                      = true
      client_prevent_user_existence_errors = "ENABLED"
      logout_urls                          = ["https://portal-test.oregon"]
      client_allowed_oauth_scopes          = ["email", "openid", "profile", "aws.cognito.signin.user.admin"]
      client_allowed_oauth_flows           = ["code", "implicit"]
      name                                 = "nebula"
      read_attributes                      = ["email"]
      supported_identity_providers         = ["COGNITO"]
      write_attributes                     = []
      access_token_validity                = 1
      id_token_validity                    = 1
      refresh_token_validity               = 30
      token_validity_units = {
        access_token  = "days"
        id_token      = "days"
        refresh_token = "days"
      }
    }

module "aws_cognito_user_pool_qrcg_users" {
  source = "lgallard/cognito-user-pool/aws"

  user_pool_name           = "qrcg-users"
  auto_verified_attributes = ["email"]
  username_attributes      = ["email"]

  admin_create_user_config_allow_admin_create_user_only = false

  domain = "qrcg-auth-service"

  email_configuration = {
    email_sending_account  = "DEVELOPER"
    reply_to_email_address = var.cognito_sender_email_email
    source_arn             = var.cognito_sender_email_arn
    from_email_address     = "${var.cognito_sender_email_name} <${var.cognito_sender_email_email}>"
  }

  client_allowed_oauth_flows                  = ["code", "implicit"]
  client_allowed_oauth_flows_user_pool_client = true
  client_allowed_oauth_scopes                 = ["email", "openid", "profile"]
  client_callback_urls                        = ["${module.app.app_url}/", "http://localhost:3000/"]
  client_default_redirect_uri                 = "${module.app.app_url}/"
  client_generate_secret                      = false
  client_logout_urls                          = ["${module.app.app_url}/logout", "http://localhost:3000/"]
  client_name                                 = var.app_name
  client_refresh_token_validity               = 60
  client_supported_identity_providers         = ["Google"]
  client_prevent_user_existence_errors        = "ENABLED"
  client_write_attributes                     = ["email"]
  client_read_attributes                      = ["email"]

  lambda_config_custom_message = module.lambda_cognito_custom_message_hook.this_lambda_function_arn

  schemas = [
    // This one is new
    {
      attribute_data_type      = "Boolean"
      developer_only_attribute = true
      mutable                  = true
      name                     = "xyz-abc"
      required                 = false
    }
  ]

  string_schemas = [
    {
      attribute_data_type      = "String"
      developer_only_attribute = false
      mutable                  = true
      name                     = "email"
      required                 = true

      string_attribute_constraints = {
        min_length = 4
        max_length = 500
      }
    },
    // This one is also new
    {
      attribute_data_type      = "String"
      developer_only_attribute = false
      mutable                  = true
      name                     = "industry"
      required                 = false

      string_attribute_constraints = {
        min_length = 0
        max_length = 10
      }
    }
  ]

  recovery_mechanisms = [
    {
      name     = "verified_email"
      priority = 1
    },
  ]
}