@aws/nx-plugin 1.0.0-rc.76 → 1.0.0-rc.77

package/src/utils/identity-constructs/files/terraform/core/user-identity/identity/identity.tf.template

@@ -28,6 +28,29 @@ variable "enable_waf" {
   default     = true
 }
 
+variable "mfa" {
+  description = "Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all"
+  type        = string
+  default     = "ON"
+
+  validation {
+    condition     = contains(["OFF", "OPTIONAL", "ON"], var.mfa)
+    error_message = "mfa must be one of OFF, OPTIONAL, ON"
+  }
+}
+
+variable "mfa_second_factor_otp" {
+  description = "Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method"
+  type        = bool
+  default     = true
+}
+
+variable "mfa_second_factor_sms" {
+  description = "Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop"
+  type        = bool
+  default     = true
+}
+
 variable "callback_urls" {
   description = "Additional callback URLs for the user pool client"
   type        = list(string)
@@ -58,10 +81,14 @@ resource "random_id" "unique_suffix" {
 }
 
 # Generate a random external ID for SMS role security
-resource "random_uuid" "sms_external_id" {}
+resource "random_uuid" "sms_external_id" {
+  count = var.mfa_second_factor_sms ? 1 : 0
+}
 
 # IAM role for SMS MFA
 resource "aws_iam_role" "cognito_sms_role" {
+  count = var.mfa_second_factor_sms ? 1 : 0
+
   name = "cognito-sms-role-${random_id.unique_suffix.hex}"
 
   assume_role_policy = jsonencode({
@@ -75,7 +102,7 @@ resource "aws_iam_role" "cognito_sms_role" {
         }
         Condition = {
           StringEquals = {
-            "sts:ExternalId" = random_uuid.sms_external_id.result
+            "sts:ExternalId" = random_uuid.sms_external_id[0].result
             "aws:SourceAccount" = data.aws_caller_identity.current.account_id
           }
           ArnLike = {
@@ -90,8 +117,10 @@ resource "aws_iam_role" "cognito_sms_role" {
 resource "aws_iam_role_policy" "cognito_sms_policy" {
   # checkov:skip=CKV_AWS_290:Cognito SMS requires sns:Publish with wildcard resource
   # checkov:skip=CKV_AWS_355:Cognito SMS requires sns:Publish with wildcard resource
+  count = var.mfa_second_factor_sms ? 1 : 0
+
   name = "cognito-sms-policy-${random_id.unique_suffix.hex}"
-  role = aws_iam_role.cognito_sms_role.id
+  role = aws_iam_role.cognito_sms_role[0].id
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -127,18 +156,23 @@ resource "aws_cognito_user_pool" "user_pool" {
   }
 
   # MFA configuration
-  mfa_configuration = "ON"
+  mfa_configuration = var.mfa
 
   # Software token MFA configuration
   software_token_mfa_configuration {
-    enabled = true
+    enabled = var.mfa_second_factor_otp
   }
 
-  # SMS MFA configuration
-  sms_configuration {
-    external_id    = random_uuid.sms_external_id.result
-    sns_caller_arn = aws_iam_role.cognito_sms_role.arn
-    sns_region     = data.aws_region.current.region
+  # SMS MFA configuration. Due to a Terraform AWS provider limitation, this also gates
+  # SMS-based phone number verification below - see the mfa_second_factor_sms variable.
+  dynamic "sms_configuration" {
+    for_each = var.mfa_second_factor_sms ? [1] : []
+
+    content {
+      external_id    = random_uuid.sms_external_id[0].result
+      sns_caller_arn = aws_iam_role.cognito_sms_role[0].arn
+      sns_region     = data.aws_region.current.region
+    }
   }
 
   depends_on = [aws_iam_role_policy.cognito_sms_policy]
@@ -158,8 +192,9 @@ resource "aws_cognito_user_pool" "user_pool" {
     }
   }
 
-  # Auto verification
-  auto_verified_attributes = ["email", "phone_number"]
+  # Auto verification. Phone number verification requires sms_configuration above, so it
+  # follows mfa_second_factor_sms - see that variable's description.
+  auto_verified_attributes = var.mfa_second_factor_sms ? ["email", "phone_number"] : ["email"]
 
   # User pool tier (equivalent to FeaturePlan.PLUS)
   user_pool_tier = "PLUS"
@@ -220,7 +255,7 @@ resource "aws_cognito_user_pool" "user_pool" {
 
   # User attribute update settings - require verification before update
   user_attribute_update_settings {
-    attributes_require_verification_before_update = ["email", "phone_number"]
+    attributes_require_verification_before_update = var.mfa_second_factor_sms ? ["email", "phone_number"] : ["email"]
   }
 
   # Verification message templates

package/src/utils/identity-constructs/files/terraform/core/user-identity/main.tf.template

@@ -4,12 +4,38 @@ variable "enable_waf" {
   default     = true
 }
 
+variable "mfa" {
+  description = "Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all"
+  type        = string
+  default     = "ON"
+
+  validation {
+    condition     = contains(["OFF", "OPTIONAL", "ON"], var.mfa)
+    error_message = "mfa must be one of OFF, OPTIONAL, ON"
+  }
+}
+
+variable "mfa_second_factor_otp" {
+  description = "Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method"
+  type        = bool
+  default     = true
+}
+
+variable "mfa_second_factor_sms" {
+  description = "Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop"
+  type        = bool
+  default     = true
+}
+
 module "identity" {
   source = "./identity"
 
   user_pool_domain_prefix = "<%= cognitoDomain %>"
   allow_signup = <%= allowSignup %>
   enable_waf = var.enable_waf
+  mfa = var.mfa
+  mfa_second_factor_otp = var.mfa_second_factor_otp
+  mfa_second_factor_sms = var.mfa_second_factor_sms
 }
 
 # Outputs