@aws/nx-plugin 1.0.0-rc.8 → 1.0.0-rc.80

package/src/utils/iac.js.map

@@ -1 +1 @@
-{"version":3,"file":"iac.js","sourceRoot":"","sources":["../../../../../packages/nx-plugin/src/utils/iac.ts"],"names":[],"mappings":";;;AAKA,0CAGwB;AAExB,iDAA0E;AAAjE,8GAAA,aAAa,OAAA;AAEtB,mDAAgD;AAYhD;;GAEG;AACI,MAAM,UAAU,GAAG,KAAK,EAC7B,IAAU,EACV,SAA0C,EACD,EAAE;IAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,IAAA,6BAAqB,EAAC,IAAI,CAAC,CAAC;QAEvD,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6DAA6D,sCAA8B,EAAE,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,6BAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,mBAAmB,sCAA8B,mBAAmB,6BAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AArBW,QAAA,UAAU,cAqBrB"}
+{"version":3,"sources":["../../../../../packages/nx-plugin/src/utils/iac.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { Tree } from '@nx/devkit';\nimport {\n  AWS_NX_PLUGIN_CONFIG_FILE_NAME,\n  readAwsNxPluginConfig,\n} from './config/utils.js';\n\nexport { IAC_PROVIDERS, type Iac, type IacOption } from './iac-providers.js';\n\nimport { IAC_PROVIDERS } from './iac-providers.js';\n\n/**\n * Configuration for infrastructure as code\n */\nexport interface IacConfig {\n  /**\n   * Default provider for infrastructure as code\n   */\n  provider: (typeof IAC_PROVIDERS)[number];\n}\n\n/**\n * Given an iac provider option, resolve the actual iac provider to use\n */\nexport const resolveIac = async (\n  tree: Tree,\n  iacOption: 'cdk' | 'terraform' | 'inherit',\n): Promise<(typeof IAC_PROVIDERS)[number]> => {\n  if (iacOption === 'inherit') {\n    const pluginConfig = readAwsNxPluginConfig(tree);\n\n    if (!pluginConfig?.iac?.provider) {\n      throw new Error(\n        `IaC provider \"inherit\" requires iac.provider to be set in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME}`,\n      );\n    }\n    if (!IAC_PROVIDERS.includes(pluginConfig.iac.provider)) {\n      throw new Error(\n        `iac.provider in ${AWS_NX_PLUGIN_CONFIG_FILE_NAME} must be one of ${IAC_PROVIDERS.join(', ')}`,\n      );\n    }\n\n    return pluginConfig.iac.provider;\n  }\n  return iacOption;\n};\n"],"names":["AWS_NX_PLUGIN_CONFIG_FILE_NAME","readAwsNxPluginConfig","IAC_PROVIDERS","resolveIac","tree","iacOption","pluginConfig","iac","provider","Error","includes","join"],"mappings":"AAAA;;;CAGC,GAED,SACEA,8BAA8B,EAC9BC,qBAAqB,QAChB,oBAAoB;AAE3B,SAASC,aAAa,QAAkC,qBAAqB;AAE7E,SAASA,aAAa,QAAQ,qBAAqB;AAYnD;;CAEC,GACD,OAAO,MAAMC,aAAa,OACxBC,MACAC;IAEA,IAAIA,cAAc,WAAW;QAC3B,MAAMC,eAAeL,sBAAsBG;QAE3C,IAAI,CAACE,cAAcC,KAAKC,UAAU;YAChC,MAAM,IAAIC,MACR,CAAC,0DAA0D,EAAET,gCAAgC;QAEjG;QACA,IAAI,CAACE,cAAcQ,QAAQ,CAACJ,aAAaC,GAAG,CAACC,QAAQ,GAAG;YACtD,MAAM,IAAIC,MACR,CAAC,gBAAgB,EAAET,+BAA+B,gBAAgB,EAAEE,cAAcS,IAAI,CAAC,OAAO;QAElG;QAEA,OAAOL,aAAaC,GAAG,CAACC,QAAQ;IAClC;IACA,OAAOH;AACT,EAAE"}

package/src/utils/identity-constructs/files/cdk/core/user-identity.ts.template

@@ -2,23 +2,69 @@ import {
   IdentityPool,
   UserPoolAuthenticationProvider,
 } from 'aws-cdk-lib/aws-cognito-identitypool';
-import { CfnOutput, CfnResource, Duration, Lazy, Stack } from 'aws-cdk-lib';
+import {
+  CfnOutput,
+  CfnResource,
+  Duration,
+  Lazy,
+  RemovalPolicy,
+  Stack,
+} from 'aws-cdk-lib';
 import {
   AccountRecovery,
   CfnManagedLoginBranding,
-  CfnUserPoolDomain,
   FeaturePlan,
+  ManagedLoginVersion,
   Mfa,
+  type MfaSecondFactor,
   OAuthScope,
+  StandardThreatProtectionMode,
   UserPool,
   UserPoolClient,
+  UserPoolDomain,
 } from 'aws-cdk-lib/aws-cognito';
+import {
+  CfnLoggingConfiguration,
+  CfnWebACL,
+  CfnWebACLAssociation,
+} from 'aws-cdk-lib/aws-wafv2';
+import { LogGroup, RetentionDays } from 'aws-cdk-lib/aws-logs';
 import { Construct } from 'constructs';
-import { RuntimeConfig } from './runtime-config.js';
+import { RuntimeConfig } from './runtime-config<% if (esm) { %>.js<% } %>';
 import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
-import { suppressRules } from './checkov.js';
+import { findCloudFrontDomainNames } from './cloudfront<% if (esm) { %>.js<% } %>';
+import { suppressRules } from './checkov<% if (esm) { %>.js<% } %>';
 
 const WEB_CLIENT_ID = 'WebClient';
+
+/** Local dev server origins permitted to complete the sign-in redirect */
+const LOCAL_CALLBACK_URLS = ['http://localhost:4200', 'http://localhost:4300'];
+
+export interface UserIdentityProps {
+  /**
+   * Whether to enable AWS WAFv2 with the default managed ruleset
+   * (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet)
+   * and associate it with the user pool.
+   *
+   * @default true
+   */
+  readonly enableWaf?: boolean;
+
+  /**
+   * Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all.
+   *
+   * @default Mfa.REQUIRED
+   */
+  readonly mfa?: Mfa;
+
+  /**
+   * The MFA methods available to users when MFA is not off.
+   *
+   * @default { sms: true, otp: true }
+   */
+  readonly mfaSecondFactor?: MfaSecondFactor;
+}
+
 /**
  * Creates a UserPool and Identity Pool with sane defaults configured intended for usage from a web client.
  */
@@ -27,13 +73,38 @@ export class UserIdentity extends Construct {
   public readonly identityPool: IdentityPool;
   public readonly userPool: UserPool;
   public readonly userPoolClient: UserPoolClient;
-  public readonly userPoolDomain: CfnUserPoolDomain;
+  public readonly userPoolDomain: UserPoolDomain;
+
+  /** The WAFv2 Web ACL associated with the user pool, if WAF is enabled */
+  public readonly webAcl?: CfnWebACL;
 
-  constructor(scope: Construct, id: string) {
+  constructor(
+    scope: Construct,
+    id: string,
+    {
+      enableWaf = true,
+      mfa = Mfa.REQUIRED,
+      mfaSecondFactor = { sms: true, otp: true },
+    }: UserIdentityProps = {},
+  ) {
     super(scope, id);
 
+    if (mfa === Mfa.REQUIRED && !mfaSecondFactor.sms && !mfaSecondFactor.otp) {
+      throw new Error(
+        'UserIdentity: mfa is REQUIRED but mfaSecondFactor has no methods enabled (sms and otp are both false)',
+      );
+    }
+
     this.region = Stack.of(this).region;
-    this.userPool = this.createUserPool();
+    this.userPool = this.createUserPool(mfa, mfaSecondFactor);
+
+    if (enableWaf) {
+      this.webAcl = this.createWebAcl(
+        id,
+        this.userPool,
+        LOCAL_CALLBACK_URLS.length > 0
+      );
+    }
     this.userPoolDomain = this.createUserPoolDomain(this.userPool);
     this.userPoolClient = this.createUserPoolClient(this.userPool);
     this.identityPool = this.createIdentityPool(
@@ -73,7 +144,12 @@ export class UserIdentity extends Construct {
     });
   }
 
-  private createUserPool = () => {
+  private createUserPool = (mfa: Mfa, mfaSecondFactor: MfaSecondFactor) => {
+    // Cognito rejects SmsConfiguration (emitted whenever phone is auto-verified) unless SMS is
+    // also an enabled MFA method, for any non-OFF MfaConfiguration. So phone verification via SMS
+    // can only be offered when SMS is actually usable as a second factor.
+    const phoneVerificationEnabled = mfa === Mfa.OFF || mfaSecondFactor.sms;
+
     const userPool = new UserPool(this, 'UserPool', {
       deletionProtection: true,
       passwordPolicy: {
@@ -84,9 +160,11 @@ export class UserIdentity extends Construct {
         requireSymbols: true,
         tempPasswordValidity: Duration.days(3),
       },
-      mfa: Mfa.REQUIRED,
+      mfa,
       featurePlan: FeaturePlan.PLUS,
-      mfaSecondFactor: { sms: true, otp: true },
+      // Audit-only logs threat assessments without blocking sign-in. Switch to FULL_FUNCTION to enforce automatic responses.
+      standardThreatProtectionMode: StandardThreatProtectionMode.AUDIT_ONLY,
+      mfaSecondFactor,
       signInCaseSensitive: false,
       signInAliases: { username: true, email: true },
       accountRecovery: AccountRecovery.EMAIL_ONLY,
@@ -99,11 +177,11 @@ export class UserIdentity extends Construct {
       },
       autoVerify: {
         email: true,
-        phone: true,
+        phone: phoneVerificationEnabled,
       },
       keepOriginal: {
         email: true,
-        phone: true,
+        phone: phoneVerificationEnabled,
       },
     });
     // Retain the SMS role alongside the pool so the pool can still be updated and deleted manually
@@ -118,24 +196,114 @@ export class UserIdentity extends Construct {
     return userPool;
   };
 
+  private createWebAcl = (
+    id: string,
+    userPool: UserPool,
+    allowsLocalCallback: boolean
+  ) => {
+    const webAcl = new CfnWebACL(this, 'WebAcl', {
+      defaultAction: { allow: {} },
+      scope: 'REGIONAL',
+      visibilityConfig: {
+        cloudWatchMetricsEnabled: true,
+        metricName: `${id}WebAcl`,
+        sampledRequestsEnabled: true,
+      },
+      rules: [
+        {
+          name: 'CRSRule',
+          priority: 0,
+          statement: {
+            managedRuleGroupStatement: {
+              name: 'AWSManagedRulesCommonRuleSet',
+              vendorName: 'AWS',
+              // EC2MetaDataSSRF_QUERYARGUMENTS treats the loopback redirect_uri the
+              // Hosted UI receives during local sign-in as an SSRF attempt. Counted
+              // only while a local callback URL is allowed; every other rule blocks.
+              ruleActionOverrides: allowsLocalCallback
+                ? [
+                    {
+                      name: 'EC2MetaDataSSRF_QUERYARGUMENTS',
+                      actionToUse: { count: {} },
+                    },
+                  ]
+                : undefined,
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: `${id}WebAcl-CRS`,
+            sampledRequestsEnabled: true,
+          },
+          overrideAction: {
+            none: {},
+          },
+        },
+        {
+          name: 'KnownBadInputsRule',
+          priority: 1,
+          statement: {
+            managedRuleGroupStatement: {
+              name: 'AWSManagedRulesKnownBadInputsRuleSet',
+              vendorName: 'AWS',
+            },
+          },
+          visibilityConfig: {
+            cloudWatchMetricsEnabled: true,
+            metricName: `${id}WebAcl-KnownBadInputs`,
+            sampledRequestsEnabled: true,
+          },
+          overrideAction: {
+            none: {},
+          },
+        },
+      ],
+    });
+
+    new CfnWebACLAssociation(this, 'WebAclAssociation', {
+      resourceArn: userPool.userPoolArn,
+      webAclArn: webAcl.attrArn,
+    });
+
+    // Send WAF request logs to CloudWatch. The log group name must start with
+    // `aws-waf-logs-` to satisfy the WAFv2 logging destination requirement.
+    const wafLogGroup = new LogGroup(this, 'WebAclLogs', {
+      logGroupName: `aws-waf-logs-${id}-${this.node.addr.slice(-8)}`,
+      retention: RetentionDays.ONE_MONTH,
+      removalPolicy: RemovalPolicy.DESTROY,
+    });
+    suppressRules(
+      wafLogGroup,
+      ['CKV_AWS_158'],
+      'Using default CloudWatch log encryption for WAF logs',
+    );
+
+    new CfnLoggingConfiguration(this, 'WebAclLoggingConfig', {
+      resourceArn: webAcl.attrArn,
+      logDestinationConfigs: [wafLogGroup.logGroupArn],
+    });
+
+    return webAcl;
+  };
+
   private createUserPoolDomain = (userPool: UserPool) =>
-    new CfnUserPoolDomain(this, 'UserPoolDomain', {
-      domain: `<%= cognitoDomain %>-${Stack.of(this).account}`,
-      userPoolId: userPool.userPoolId,
-      managedLoginVersion: 2,
+    new UserPoolDomain(this, 'UserPoolDomain', {
+      userPool,
+      cognitoDomain: {
+        domainPrefix: `<%= cognitoDomain %>-${Stack.of(this).account}`,
+      },
+      managedLoginVersion: ManagedLoginVersion.NEWER_MANAGED_LOGIN,
     });
 
   private createUserPoolClient = (userPool: UserPool) => {
     const lazilyComputedCallbackUrls = Lazy.list({
       produce: () =>
-        [
-          'http://localhost:4200',
-          'http://localhost:4300',
-          `https://${Stack.of(this).region}.console.aws.amazon.com`,
-        ].concat(
-          this.findCloudFrontDistributions().map(
-            (d) => `https://${d.domainName}`
-          )
+        LOCAL_CALLBACK_URLS.concat(
+          Stack.of(this)
+            .node.findAll()
+            .filter((child): child is Distribution => child instanceof Distribution)
+            .flatMap(findCloudFrontDomainNames)
+            .map((domain) => `https://${domain}`)
         ),
     });
 
@@ -176,7 +344,7 @@ export class UserIdentity extends Construct {
   private createManagedLoginBranding = (
     userPool: UserPool,
     userPoolClient: UserPoolClient,
-    userPoolDomain: CfnUserPoolDomain
+    userPoolDomain: UserPoolDomain
   ) => {
     new CfnManagedLoginBranding(this, 'ManagedLoginBranding', {
       userPoolId: userPool.userPoolId,
@@ -184,9 +352,4 @@ export class UserIdentity extends Construct {
       useCognitoProvidedValues: true,
     }).node.addDependency(userPoolClient, userPool, userPoolDomain);
   };
-
-  private findCloudFrontDistributions = (): Distribution[] =>
-    Stack.of(this)
-      .node.findAll()
-      .filter((child) => child instanceof Distribution);
 }

package/src/utils/identity-constructs/files/terraform/core/user-identity/add-callback-url/add-callback-url.tf.template

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
     }
   }
 }
@@ -59,24 +59,38 @@ resource "null_resource" "add_callback_url" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3 python -c "
+      uv run --with boto3<%= boto3Version %> python -c "
 import boto3
+import os
 import sys
+import time
 
 # Configuration
-user_pool_id = '${local.user_pool_id}'
-client_id = '${local.user_pool_client_id}'
-new_callback_url = '${var.callback_url}'
+user_pool_id = os.environ['USER_POOL_ID']
+client_id = os.environ['CLIENT_ID']
+new_callback_url = os.environ['NEW_CALLBACK_URL']
 
 # Initialize Cognito client
 cognito = boto3.client('cognito-idp')
 
+# A freshly created user pool / client can take several minutes to become
+# visible to describe_user_pool_client, so retry on ResourceNotFoundException.
+def describe_with_retry():
+    deadline = time.time() + 5 * 60
+    while True:
+        try:
+            return cognito.describe_user_pool_client(
+                UserPoolId=user_pool_id,
+                ClientId=client_id,
+            )
+        except cognito.exceptions.ResourceNotFoundException:
+            if time.time() >= deadline:
+                raise
+            time.sleep(5)
+
 try:
     # Get current user pool client configuration
-    response = cognito.describe_user_pool_client(
-        UserPoolId=user_pool_id,
-        ClientId=client_id
-    )
+    response = describe_with_retry()
 
     client_config = response['UserPoolClient']
     current_callback_urls = client_config.get('CallbackURLs', [])
@@ -118,6 +132,11 @@ except Exception as e:
     sys.exit(1)
 "
     EOT
+    environment = {
+      USER_POOL_ID     = local.user_pool_id
+      CLIENT_ID        = local.user_pool_client_id
+      NEW_CALLBACK_URL = var.callback_url
+    }
   }
 
   depends_on = [terraform_data.validate_cognito_props]

package/src/utils/identity-constructs/files/terraform/core/user-identity/identity/identity.tf.template

@@ -2,11 +2,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "<%- awsProviderVersion %>"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "<%- randomProviderVersion %>"
     }
   }
 }
@@ -22,6 +22,35 @@ variable "allow_signup" {
   type        = bool
 }
 
+variable "enable_waf" {
+  description = "Whether to enable AWS WAFv2 with the default managed ruleset (AWSManagedRulesCommonRuleSet and AWSManagedRulesKnownBadInputsRuleSet) and associate it with the user pool"
+  type        = bool
+  default     = true
+}
+
+variable "mfa" {
+  description = "Whether users must configure MFA, may optionally configure MFA, or cannot use MFA at all"
+  type        = string
+  default     = "ON"
+
+  validation {
+    condition     = contains(["OFF", "OPTIONAL", "ON"], var.mfa)
+    error_message = "mfa must be one of OFF, OPTIONAL, ON"
+  }
+}
+
+variable "mfa_second_factor_otp" {
+  description = "Whether users can use a time-based one time password (TOTP), generated by a hardware or software token, as an MFA method"
+  type        = bool
+  default     = true
+}
+
+variable "mfa_second_factor_sms" {
+  description = "Whether users can use SMS to their verified phone numbers as an MFA method. Due to a Terraform AWS provider limitation, disabling this also disables SMS-based phone number verification, unlike the equivalent CDK construct prop"
+  type        = bool
+  default     = true
+}
+
 variable "callback_urls" {
   description = "Additional callback URLs for the user pool client"
   type        = list(string)
@@ -38,16 +67,28 @@ variable "logout_urls" {
 data "aws_caller_identity" "current" {}
 data "aws_region" "current" {}
 
+locals {
+  # Local dev server origins permitted to complete the sign-in redirect
+  local_callback_urls = [
+    "http://localhost:4200",
+    "http://localhost:4300"
+  ]
+}
+
 # Random suffix for resource names
 resource "random_id" "unique_suffix" {
   byte_length = 4
 }
 
 # Generate a random external ID for SMS role security
-resource "random_uuid" "sms_external_id" {}
+resource "random_uuid" "sms_external_id" {
+  count = var.mfa_second_factor_sms ? 1 : 0
+}
 
 # IAM role for SMS MFA
 resource "aws_iam_role" "cognito_sms_role" {
+  count = var.mfa_second_factor_sms ? 1 : 0
+
   name = "cognito-sms-role-${random_id.unique_suffix.hex}"
 
   assume_role_policy = jsonencode({
@@ -61,7 +102,7 @@ resource "aws_iam_role" "cognito_sms_role" {
         }
         Condition = {
           StringEquals = {
-            "sts:ExternalId" = random_uuid.sms_external_id.result
+            "sts:ExternalId" = random_uuid.sms_external_id[0].result
             "aws:SourceAccount" = data.aws_caller_identity.current.account_id
           }
           ArnLike = {
@@ -76,8 +117,10 @@ resource "aws_iam_role" "cognito_sms_role" {
 resource "aws_iam_role_policy" "cognito_sms_policy" {
   # checkov:skip=CKV_AWS_290:Cognito SMS requires sns:Publish with wildcard resource
   # checkov:skip=CKV_AWS_355:Cognito SMS requires sns:Publish with wildcard resource
+  count = var.mfa_second_factor_sms ? 1 : 0
+
   name = "cognito-sms-policy-${random_id.unique_suffix.hex}"
-  role = aws_iam_role.cognito_sms_role.id
+  role = aws_iam_role.cognito_sms_role[0].id
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -113,18 +156,23 @@ resource "aws_cognito_user_pool" "user_pool" {
   }
 
   # MFA configuration
-  mfa_configuration = "ON"
+  mfa_configuration = var.mfa
 
   # Software token MFA configuration
   software_token_mfa_configuration {
-    enabled = true
+    enabled = var.mfa_second_factor_otp
   }
 
-  # SMS MFA configuration
-  sms_configuration {
-    external_id    = random_uuid.sms_external_id.result
-    sns_caller_arn = aws_iam_role.cognito_sms_role.arn
-    sns_region     = data.aws_region.current.region
+  # SMS MFA configuration. Due to a Terraform AWS provider limitation, this also gates
+  # SMS-based phone number verification below - see the mfa_second_factor_sms variable.
+  dynamic "sms_configuration" {
+    for_each = var.mfa_second_factor_sms ? [1] : []
+
+    content {
+      external_id    = random_uuid.sms_external_id[0].result
+      sns_caller_arn = aws_iam_role.cognito_sms_role[0].arn
+      sns_region     = data.aws_region.current.region
+    }
   }
 
   depends_on = [aws_iam_role_policy.cognito_sms_policy]
@@ -144,12 +192,18 @@ resource "aws_cognito_user_pool" "user_pool" {
     }
   }
 
-  # Auto verification
-  auto_verified_attributes = ["email", "phone_number"]
+  # Auto verification. Phone number verification requires sms_configuration above, so it
+  # follows mfa_second_factor_sms - see that variable's description.
+  auto_verified_attributes = var.mfa_second_factor_sms ? ["email", "phone_number"] : ["email"]
 
   # User pool tier (equivalent to FeaturePlan.PLUS)
   user_pool_tier = "PLUS"
 
+  # Threat protection. AUDIT logs threat assessments without blocking sign-in; switch to ENFORCED to apply automatic responses.
+  user_pool_add_ons {
+    advanced_security_mode = "AUDIT"
+  }
+
   # Schema attributes
   schema {
     attribute_data_type = "String"
@@ -201,7 +255,7 @@ resource "aws_cognito_user_pool" "user_pool" {
 
   # User attribute update settings - require verification before update
   user_attribute_update_settings {
-    attributes_require_verification_before_update = ["email", "phone_number"]
+    attributes_require_verification_before_update = var.mfa_second_factor_sms ? ["email", "phone_number"] : ["email"]
   }
 
   # Verification message templates
@@ -225,6 +279,112 @@ resource "aws_cognito_user_pool_domain" "user_pool_domain" {
   managed_login_version   = 2
 }
 
+# WAFv2 Web ACL for the user pool
+resource "aws_wafv2_web_acl" "user_pool_waf" {
+  #checkov:skip=CKV2_AWS_31:Logging configuration is defined below in aws_wafv2_web_acl_logging_configuration.user_pool_waf_logging; Checkov does not resolve the separate resource
+  count = var.enable_waf ? 1 : 0
+
+  name  = "UserPool-${random_id.unique_suffix.hex}-waf"
+  scope = "REGIONAL"
+
+  default_action {
+    allow {}
+  }
+
+  rule {
+    name     = "CRSRule"
+    priority = 0
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+
+        # EC2MetaDataSSRF_QUERYARGUMENTS treats the loopback redirect_uri the
+        # Hosted UI receives during local sign-in as an SSRF attempt. Counted
+        # only while a local callback URL is allowed; every other rule blocks.
+        dynamic "rule_action_override" {
+          for_each = length(local.local_callback_urls) > 0 ? [1] : []
+
+          content {
+            name = "EC2MetaDataSSRF_QUERYARGUMENTS"
+
+            action_to_use {
+              count {}
+            }
+          }
+        }
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "UserPoolWebAcl-CRS"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  rule {
+    name     = "KnownBadInputsRule"
+    priority = 1
+
+    override_action {
+      none {}
+    }
+
+    statement {
+      managed_rule_group_statement {
+        name        = "AWSManagedRulesKnownBadInputsRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name                = "UserPoolWebAcl-KnownBadInputs"
+      sampled_requests_enabled   = true
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = "UserPoolWebAcl"
+    sampled_requests_enabled   = true
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_wafv2_web_acl_association" "user_pool_waf_association" {
+  count = var.enable_waf ? 1 : 0
+
+  resource_arn = aws_cognito_user_pool.user_pool.arn
+  web_acl_arn  = aws_wafv2_web_acl.user_pool_waf[0].arn
+}
+
+# CloudWatch Log Group for WAF request logs. Name must start with `aws-waf-logs-`.
+resource "aws_cloudwatch_log_group" "user_pool_waf_logs" {
+  #checkov:skip=CKV_AWS_158:Using default CloudWatch log encryption
+  #checkov:skip=CKV_AWS_338:Log retention set to one month which is sufficient for WAF logs
+  count = var.enable_waf ? 1 : 0
+
+  name              = "aws-waf-logs-UserPool-${random_id.unique_suffix.hex}"
+  retention_in_days = 30
+}
+
+resource "aws_wafv2_web_acl_logging_configuration" "user_pool_waf_logging" {
+  count = var.enable_waf ? 1 : 0
+
+  log_destination_configs = [aws_cloudwatch_log_group.user_pool_waf_logs[0].arn]
+  resource_arn            = aws_wafv2_web_acl.user_pool_waf[0].arn
+}
+
 # User Pool Client
 resource "aws_cognito_user_pool_client" "web_client" {
   name         = "WebClient-${random_id.unique_suffix.hex}"
@@ -247,17 +407,9 @@ resource "aws_cognito_user_pool_client" "web_client" {
   allowed_oauth_scopes = ["email", "openid", "profile"]
 
   # OAuth-dependent URLs - set after OAuth configuration
-  callback_urls = concat([
-    "http://localhost:4200",
-    "http://localhost:4300",
-    "https://${data.aws_region.current.region}.console.aws.amazon.com"
-  ], var.callback_urls)
+  callback_urls = concat(local.local_callback_urls, var.callback_urls)
 
-  logout_urls = concat([
-    "http://localhost:4200",
-    "http://localhost:4300",
-    "https://${data.aws_region.current.region}.console.aws.amazon.com"
-  ], var.logout_urls)
+  logout_urls = concat(local.local_callback_urls, var.logout_urls)
 
   # Security settings
   prevent_user_existence_errors = "ENABLED"