Custom Sender SMS & Email with third-party about terraform-aws-cognito-user-pool HOT 9 CLOSED

#!/bin/bash
set -e

STAGE="${STAGE:-$1}"

echo "Running terraform post-apply-hook for stage '$STAGE' on region '$AWS_REGION'"
if [[ "$STAGE" != "development" ]] && [[ "$STAGE" != "production" ]]; then
    echo "Unknown stage: $STAGE"
    exit 1
fi

LAMBDA_CUSTOM_SENDER_NAME="AwsCognito_CustomSender"
LAMBDA_CUSTOM_SENDER_ARN=$(aws lambda get-function --function-name "$LAMBDA_CUSTOM_SENDER_NAME" | jq -r -c '.Configuration | .FunctionArn')

LAMBDA_PRE_SIGNUP_NAME="AwsCognito_PreSignUp"
LAMBDA_PRE_SIGNUP_ARN=$(aws lambda get-function --function-name "$LAMBDA_PRE_SIGNUP_NAME" | jq -r -c '.Configuration | .FunctionArn')

LAMBDA_POST_AUTHENTICATION_NAME="AwsCognito_PostAuthentication"
LAMBDA_POST_AUTHENTICATION_ARN=$(aws lambda get-function --function-name "$LAMBDA_POST_AUTHENTICATION_NAME" | jq -r -c '.Configuration | .FunctionArn')

LAMBDA_POST_CONFIRMATION_NAME="AwsCognito_PostConfirmation"
LAMBDA_POST_CONFIRMATION_ARN=$(aws lambda get-function --function-name "$LAMBDA_POST_CONFIRMATION_NAME" | jq -r -c '.Configuration | .FunctionArn')

LAMBDA_USER_MIGRATION_NAME="AwsCognito_UserMigration"
LAMBDA_USER_MIGRATION_ARN=$(aws lambda get-function --function-name "$LAMBDA_USER_MIGRATION_NAME" | jq -r -c '.Configuration | .FunctionArn')

LAMBDA_AUTH_CHALLENGE_CREATE_NAME="AwsCognito_AuthChallengeCreate"
LAMBDA_AUTH_CHALLENGE_CREATE_ARN=$(aws lambda get-function --function-name "$LAMBDA_AUTH_CHALLENGE_CREATE_NAME" | jq -r -c '.Configuration | .FunctionArn')

LAMBDA_AUTH_CHALLENGE_DEFINE_NAME="AwsCognito_AuthChallengeDefine"
LAMBDA_AUTH_CHALLENGE_DEFINE_ARN=$(aws lambda get-function --function-name "$LAMBDA_AUTH_CHALLENGE_DEFINE_NAME" | jq -r -c '.Configuration | .FunctionArn')

LAMBDA_AUTH_CHALLENGE_VERIFY_NAME="AwsCognito_AuthChallengeVerify"
LAMBDA_AUTH_CHALLENGE_VERIFY_ARN=$(aws lambda get-function --function-name "$LAMBDA_AUTH_CHALLENGE_VERIFY_NAME" | jq -r -c '.Configuration | .FunctionArn')

KMS_KEY_ALIAS="lambda-custom-email-sender"
KMS_KEY_ID=$(aws kms list-aliases | jq -r -c '.Aliases[] | select(.AliasName | contains("'$KMS_KEY_ALIAS'")) | .TargetKeyId')
KMS_KEY_ARN=$(aws kms describe-key --key-id $KMS_KEY_ID | jq -r -c '.KeyMetadata | .Arn')

LAMBDA_CONFIG="CustomEmailSender={LambdaVersion=V1_0,LambdaArn=$LAMBDA_CUSTOM_SENDER_ARN},PreSignUp=$LAMBDA_PRE_SIGNUP_ARN,PostAuthentication=$LAMBDA_POST_AUTHENTICATION_ARN,PostConfirmation=$LAMBDA_POST_CONFIRMATION_ARN,UserMigration=$LAMBDA_USER_MIGRATION_ARN,CreateAuthChallenge=$LAMBDA_AUTH_CHALLENGE_CREATE_ARN,DefineAuthChallenge=$LAMBDA_AUTH_CHALLENGE_DEFINE_ARN,VerifyAuthChallengeResponse=$LAMBDA_AUTH_CHALLENGE_VERIFY_ARN,KMSKeyID=$KMS_KEY_ARN"

USER_POOL_NAME="qrcg-users-$STAGE"
echo "Looking for userpool: $USER_POOL_NAME"
USER_POOL_ID=$(aws cognito-idp list-user-pools --max-results 10 | jq -r -c '.UserPools[] | select(.Name | contains("'$USER_POOL_NAME'")) | .Id')

echo "Lambda config:"
echo $LAMBDA_CONFIG

# cf. https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/update-user-pool.html
echo "Updating user-pool '$USER_POOL_ID' for lambda '$LAMBDA_CUSTOM_SENDER_ARN'"
aws cognito-idp update-user-pool --user-pool-id $USER_POOL_ID --lambda-config $LAMBDA_CONFIG --auto-verified-attributes "email"

echo "Describing user-pool"
aws cognito-idp list-user-pools --max-results 10 | jq '.UserPools[] | select(.Name | contains("'$USER_POOL_NAME'"))'

resource "aws_kms_key" "kms_key_lambda_custom_email_sender" {
  description = "Custom KMS key for AWS cognito lambda"
}

resource "aws_kms_alias" "kms_key_lambda_custom_email_sender_alias" {
  name          = "alias/lambda-custom-email-sender"
  target_key_id = aws_kms_key.kms_key_lambda_custom_email_sender.key_id
}

  dynamic "lambda_config" {
    for_each = var.lambda_config == null && length(join("", values(local.lambda_config[0]))) == 0 ? [] : local.lambda_config
    content {
      create_auth_challenge          = lookup(lambda_config.value, "create_auth_challenge")
      custom_message                 = lookup(lambda_config.value, "custom_message")
      define_auth_challenge          = lookup(lambda_config.value, "define_auth_challenge")
      post_authentication            = lookup(lambda_config.value, "post_authentication")
      post_confirmation              = lookup(lambda_config.value, "post_confirmation")
      pre_authentication             = lookup(lambda_config.value, "pre_authentication")
      pre_sign_up                    = lookup(lambda_config.value, "pre_sign_up")
      pre_token_generation           = lookup(lambda_config.value, "pre_token_generation")
      user_migration                 = lookup(lambda_config.value, "user_migration")
      verify_auth_challenge_response = lookup(lambda_config.value, "verify_auth_challenge_response")
      kms_key_id                     = lookup(lambda_config.value, "kms_key_id")
      dynamic "custom_email_sender" {
        for_each = lambda_config.value["custom_email_sender"]
        content {
          lambda_arn     = custom_email_sender.value["lambda_arn"]
          lambda_version = custom_email_sender.value["lambda_version"]
        }
      }
      dynamic "custom_sms_sender" {
        for_each = lambda_config.value["custom_sms_sender"]
        content {
          lambda_arn     = custom_sms_sender.value["lambda_arn"]
          lambda_version = custom_sms_sender.value["lambda_version"]
        }
      }
    }
  }

 for_each = var.lambda_config == null && length(join("", values(local.lambda_config[0]))) == 0 ? [] : local.lambda_config

for_each = var.lambda_config == null && length(local.lambda_config) == 0 ? [] : local.lambda_config