@mettlecast/domain-cdk-packer 0.2.71 → 0.2.72
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/DomainStack.js +22 -0
- package/package.json +1 -1
package/dist/DomainStack.js
CHANGED
|
@@ -167,6 +167,9 @@ export class DomainStack extends cdk.Stack {
|
|
|
167
167
|
if (dbSecretArn) {
|
|
168
168
|
environment.DB_SECRET_ARN = dbSecretArn;
|
|
169
169
|
}
|
|
170
|
+
if (userPoolId) {
|
|
171
|
+
environment.COGNITO_USER_POOL_ID = userPoolId;
|
|
172
|
+
}
|
|
170
173
|
const resolveSubnetSelection = (access) => {
|
|
171
174
|
if (access === 'internet')
|
|
172
175
|
return internetSubnetSelection ?? internalSubnetSelection;
|
|
@@ -513,6 +516,25 @@ export class DomainStack extends cdk.Stack {
|
|
|
513
516
|
domainTable.grantReadWriteData(fn);
|
|
514
517
|
domainBucket.grantReadWrite(fn);
|
|
515
518
|
}
|
|
519
|
+
// Grant Cognito Admin permissions when a user pool is configured.
|
|
520
|
+
// The auth domain's provision-cognito-user internal action needs
|
|
521
|
+
// AdminCreateUser, AdminSetUserPassword, and AdminGetUser to
|
|
522
|
+
// provision users during the invite & register flow.
|
|
523
|
+
if (userPoolId) {
|
|
524
|
+
const userPoolArn = `arn:aws:cognito-idp:${this.region}:${this.account}:userpool/${userPoolId}`;
|
|
525
|
+
for (const fn of allDomainLambdas) {
|
|
526
|
+
fn.addToRolePolicy(new iam.PolicyStatement({
|
|
527
|
+
actions: [
|
|
528
|
+
'cognito-idp:AdminCreateUser',
|
|
529
|
+
'cognito-idp:AdminSetUserPassword',
|
|
530
|
+
'cognito-idp:AdminGetUser',
|
|
531
|
+
'cognito-idp:AdminDeleteUser',
|
|
532
|
+
'cognito-idp:AdminUpdateUserAttributes',
|
|
533
|
+
],
|
|
534
|
+
resources: [userPoolArn],
|
|
535
|
+
}));
|
|
536
|
+
}
|
|
537
|
+
}
|
|
516
538
|
// Replace the tenant-scoped role trust policy — only domain Lambdas can assume with tenantId tag
|
|
517
539
|
// Use a single Statement with ArnLike wildcard to stay under the 2048-byte ACL size limit
|
|
518
540
|
const cfnRole = tenantScopedRole.node.defaultChild;
|