@takumi-stack/core 1.0.0 → 1.0.1

package/common/synth/props-types.ts

@@ -0,0 +1,79 @@
+export type BaseRegionName = 'us-east-1' | string;
+
+export type BaseEnvName = 'dev' | 'test' | 'staging' | 'prod' | string;
+
+export type BaseDeployTargetName = 'services' | string;
+
+export interface DeployConfig {
+  region: BaseRegionName;
+  account: string;
+}
+
+// Global Config
+
+export type BaseGlobalConstConfig<ExtendedConst = {}> = {
+  projectName: string;
+  projectShortName: string;
+  repositoryName: string;
+  landingZones: string[];
+  pipelineNotificationSlackChannel?: string;
+  isDemoProject?: boolean;
+  bootstrappingServices?: string[];
+  isSingleProjectAccount?: boolean;
+} & ExtendedConst;
+
+export type BaseGlobalEnv<ExtendedEnv = {}> = {
+  roleName: string;
+  deployBranch: string;
+  hostedZoneName: string;
+  envDomainName: string;
+  emailSender: string;
+} & ExtendedEnv;
+
+export type BaseGlobalEnvConfig<AllowedEnv extends BaseEnvName = BaseEnvName, GlobalEnv extends BaseGlobalEnv = BaseGlobalEnv> = Record<
+  AllowedEnv,
+  GlobalEnv
+>;
+
+export type BaseGlobalDeployTarget<DeployTargetName extends BaseDeployTargetName = BaseDeployTargetName> = Record<DeployTargetName, DeployConfig>;
+
+export type BaseGlobalDeployTargetConfig<
+  AllowedEnv extends BaseEnvName = BaseEnvName,
+  DeployTargetName extends BaseDeployTargetName = BaseDeployTargetName,
+  GlobalDeployTarget extends BaseGlobalDeployTarget<DeployTargetName> = BaseGlobalDeployTarget<DeployTargetName>,
+> = Record<AllowedEnv, GlobalDeployTarget>;
+
+// Service Config
+
+export type BaseServiceDependencies<ServiceDependencies = {}> = {} & ServiceDependencies;
+
+export type BaseServiceConstConfig<ExtendedConst = {}> = {} & ExtendedConst;
+
+export type BaseServiceEnv<ExtendedEnv = {}> = {} & ExtendedEnv;
+
+export type BaseServiceEnvConfig<AllowedEnv extends BaseEnvName = BaseEnvName, ServiceEnv extends BaseServiceEnv = BaseServiceEnv> = Record<
+  AllowedEnv,
+  ServiceEnv
+>;
+
+// Composition Props
+
+export type BaseGlobalProps<
+  GlobalConstConfig extends BaseGlobalConstConfig = BaseGlobalConstConfig,
+  GlobalEnv extends BaseGlobalEnv = BaseGlobalEnv,
+  GlobalDeployTarget extends BaseGlobalDeployTarget = BaseGlobalDeployTarget,
+> = {
+  envName: BaseEnvName;
+  regionName: BaseRegionName;
+  ephemeralEnvName?: string;
+  deployTarget: GlobalDeployTarget;
+} & GlobalConstConfig &
+  GlobalEnv;
+
+export type BaseServiceProps<
+  GlobalProps extends BaseGlobalProps = BaseGlobalProps,
+  ServiceDependencies extends BaseServiceDependencies = BaseServiceDependencies,
+> = {
+  serviceName: string;
+} & GlobalProps &
+  ServiceDependencies;

package/common/synth/synth-error.ts

@@ -0,0 +1,13 @@
+import { BaseServiceProps } from './props-types';
+
+export class SynthError extends Error {
+  constructor(
+    public override message: string,
+    public props?: BaseServiceProps
+  ) {
+    super(message);
+    this.message = `[${props?.serviceName || 'UnknownService'}] ${message}`;
+    const actualProto = new.target.prototype;
+    Object.setPrototypeOf(this, actualProto);
+  }
+}

package/index.ts

@@ -0,0 +1,3 @@
+export * from './common';
+export * from './prefab';
+export * from './script';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takumi-stack/core",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "author": "sinapsis.co",
   "license": "MIT",
   "main": "./index.js",
@@ -16,7 +16,6 @@
     "@aws-sdk/client-ssm": "^3.632.0",
     "@aws-sdk/client-sts": "^3.632.0",
     "@aws-sdk/lib-dynamodb": "^3.632.0",
-    "@takumi-stack/sdk": "^1.0.2",
     "@types/node": "^22.3.0",
     "aws-cdk-lib": "^2.152.0",
     "aws-lambda": "^1.0.7",
@@ -27,7 +26,8 @@
     "open-next": "^2.3.9",
     "reflect-metadata": "^0.1.14",
     "type-graphql": "^1.1.1",
-    "typeorm": "^0.3.20"
+    "typeorm": "^0.3.20",
+    "@takumi-stack/sdk": "1.0.3"
   },
   "devDependencies": {
     "@trivago/prettier-plugin-sort-imports": "^4.3.0",
@@ -36,8 +36,7 @@
     "cdk": "^2.152.0"
   },
   "scripts": {
-    "build": "tsc && npx tsc-alias",
-    "release": "cp package.json .dist/package.json && cd .dist && pnpm publish --access public && cd ..",
+    "build": "tsc",
     "lint": "eslint . --max-warnings 0"
   }
 }

package/prefab/analytics/events/handlers/ingestion-transform/handler.ts

@@ -0,0 +1,35 @@
+import * as awsLambda from 'aws-lambda';
+
+const createDroppedRecord = (recordId: string): awsLambda.FirehoseTransformationResultRecord => {
+  return { recordId, result: 'Dropped', data: Buffer.from('').toString('base64') };
+};
+
+const processData = (payloadStr: string): Object => {
+  return JSON.parse(payloadStr);
+};
+
+const transformRecord = (record: awsLambda.FirehoseTransformationEventRecord): awsLambda.FirehoseTransformationResultRecord => {
+  try {
+    const payloadStr = Buffer.from(record.data, 'base64').toString();
+    const jsonRecord = processData(payloadStr);
+    if (!jsonRecord) {
+      console.error('Error creating json record');
+      return createDroppedRecord(record.recordId);
+    }
+    return {
+      recordId: record.recordId,
+      result: 'Ok',
+      data: Buffer.from(JSON.stringify(jsonRecord) + '\n').toString('base64'),
+    };
+  } catch (error) {
+    console.error('Error processing record ${record.recordId}: ', error);
+    return createDroppedRecord(record.recordId);
+  }
+};
+
+export const handler: awsLambda.FirehoseTransformationHandler = async (
+  event: awsLambda.FirehoseTransformationEvent
+): Promise<awsLambda.FirehoseTransformationResult> => {
+  const records: awsLambda.FirehoseTransformationResultRecord[] = event.records.map((r) => transformRecord(r));
+  return { records };
+};

package/prefab/analytics/events/index.ts

@@ -0,0 +1,192 @@
+import { CfnOutput, Duration, RemovalPolicy } from 'aws-cdk-lib';
+import { CfnWorkGroup } from 'aws-cdk-lib/aws-athena';
+import { Rule } from 'aws-cdk-lib/aws-events';
+import { KinesisFirehoseStream } from 'aws-cdk-lib/aws-events-targets';
+import { CfnCrawler, CfnCrawlerProps, CfnDatabase } from 'aws-cdk-lib/aws-glue';
+import { Effect, PolicyStatement, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { CfnDeliveryStream } from 'aws-cdk-lib/aws-kinesisfirehose';
+import { BlockPublicAccess, Bucket, BucketEncryption, StorageClass } from 'aws-cdk-lib/aws-s3';
+import { Construct } from 'constructs';
+
+import { ServiceStack, getBucketName, getDatabaseName, getDeployConfig, getLogicalName, getResourceName } from '../../../common';
+import { BaseFunction } from '../../compute';
+import { EventBusPrefab } from '../../integration';
+
+export type EventsAnalyticsParams = {
+  eventBus: EventBusPrefab;
+  eventSource?: string;
+  paramsCrawlerProps?: Partial<CfnCrawlerProps>;
+  lifecycleDurations?: {
+    infrequentDays: number;
+    glacierDays: number;
+  };
+  bufferingHints?: {
+    intervalInSeconds: number;
+    sizeInMBs: number;
+  };
+};
+
+export class EventsAnalyticsPrefab extends Construct {
+  public readonly datalakeBucket: Bucket;
+  public readonly database: CfnDatabase;
+  public readonly crawler: CfnCrawler;
+  public readonly athenaOutputBucket: Bucket;
+  public readonly workGroup: CfnWorkGroup;
+
+  constructor(service: ServiceStack, params: EventsAnalyticsParams) {
+    super(service, getLogicalName(EventsAnalyticsPrefab.name));
+
+    this.datalakeBucket = new Bucket(service, 'DataLakeBucket', {
+      bucketName: getBucketName('datalake', service.props),
+      versioned: false,
+      publicReadAccess: false,
+      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+      encryption: BucketEncryption.KMS_MANAGED,
+      removalPolicy: RemovalPolicy.DESTROY,
+      ...(service.props.envName !== 'prod' ? { autoDeleteObjects: true } : {}),
+      lifecycleRules: [
+        {
+          transitions: [
+            {
+              storageClass: StorageClass.INFREQUENT_ACCESS,
+              transitionAfter: Duration.days(params.lifecycleDurations?.infrequentDays || 90),
+            },
+            {
+              storageClass: StorageClass.GLACIER,
+              transitionAfter: Duration.days(params.lifecycleDurations?.glacierDays || 360),
+            },
+          ],
+        },
+      ],
+    });
+    if (service.props.envName === 'prod') {
+      this.datalakeBucket.applyRemovalPolicy(RemovalPolicy.RETAIN);
+    }
+
+    const role = new Role(service, getLogicalName('DataLakeDeliveryStringRole'), {
+      assumedBy: new ServicePrincipal('firehose.amazonaws.com'),
+    });
+
+    const lambdaFunction = new BaseFunction(service, {
+      name: 'ingestion-transform',
+      baseFunctionFolder: __dirname,
+      ...(service.props.isDemoProject ? {} : { compiled: true }),
+    }).lambdaFunction;
+
+    const deliveryStream = new CfnDeliveryStream(service, 'DataLakeDeliveryStream', {
+      deliveryStreamType: 'DirectPut',
+      extendedS3DestinationConfiguration: {
+        bucketArn: this.datalakeBucket.bucketArn,
+        roleArn: role.roleArn,
+        compressionFormat: 'UNCOMPRESSED',
+        prefix: 'year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/hour=!{timestamp:HH}/',
+        errorOutputPrefix: 'error/!{firehose:random-string}/!{firehose:error-output-type}/!{timestamp:yyyy/MM/dd}/',
+        bufferingHints: {
+          intervalInSeconds: params.bufferingHints?.intervalInSeconds || 300,
+          sizeInMBs: params.bufferingHints?.sizeInMBs || 5,
+        },
+        processingConfiguration: {
+          enabled: true,
+          processors: [
+            {
+              type: 'Lambda',
+              parameters: [{ parameterName: 'LambdaArn', parameterValue: lambdaFunction.functionArn }],
+            },
+          ],
+        },
+      },
+    });
+
+    new Rule(service, 'EventProcessorRule', {
+      ...(params.eventBus ? { eventBus: params.eventBus.bus } : {}),
+      eventPattern: { source: [params.eventSource || 'app'] },
+      targets: [new KinesisFirehoseStream(deliveryStream)],
+    });
+
+    this.datalakeBucket.grantReadWrite(role);
+    lambdaFunction.grantInvoke(role);
+
+    this.database = new CfnDatabase(service, 'Database', {
+      catalogId: getDeployConfig(service.props).env.account,
+      databaseInput: { name: getDatabaseName('datalake', service.props) },
+    });
+
+    const crawlerRole = new Role(service, 'CrawlerRole', { assumedBy: new ServicePrincipal('glue.amazonaws.com') });
+
+    crawlerRole.addToPrincipalPolicy(
+      new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: [
+          'glue:*',
+          's3:GetBucketLocation',
+          's3:ListBucket',
+          's3:ListAllMyBuckets',
+          'iam:ListRolePolicies',
+          'iam:GetRole',
+          'iam:GetRolePolicy',
+          'cloudwatch:PutMetricData',
+          'logs:PutLogEvents',
+          'logs:CreateLogGroup',
+          'logs:CreateLogStream',
+        ],
+        resources: ['*'],
+      })
+    );
+
+    this.datalakeBucket.grantReadWrite(crawlerRole);
+
+    this.crawler = new CfnCrawler(this, 'DatalakeTableCrawler', {
+      name: getResourceName('crawler', service.props),
+      databaseName: this.database.ref.toString(),
+      role: crawlerRole.roleArn,
+      targets: { s3Targets: [{ path: this.datalakeBucket.bucketName }] },
+      configuration: JSON.stringify({
+        Version: 1.0,
+        Grouping: { TableGroupingPolicy: 'CombineCompatibleSchemas' },
+        CrawlerOutput: {
+          Tables: { AddOrUpdateBehavior: 'MergeNewColumns' },
+          Partitions: { AddOrUpdateBehavior: 'InheritFromTable' },
+        },
+      }),
+      schemaChangePolicy: {
+        deleteBehavior: 'DELETE_FROM_DATABASE',
+        updateBehavior: 'UPDATE_IN_DATABASE',
+      },
+      ...params.paramsCrawlerProps,
+    });
+
+    new CfnOutput(service, 'CrawlerName', {
+      exportName: getResourceName('CrawlerName', service.props),
+      value: this.crawler.name as string,
+    });
+    new CfnOutput(service, 'DatabaseName', {
+      exportName: getResourceName('DatabaseName', service.props),
+      value: this.database.ref.toString(),
+    });
+    new CfnOutput(service, 'TableName', {
+      exportName: getResourceName('TableName', service.props),
+      value: getDatabaseName('datalake', service.props),
+    });
+
+    this.athenaOutputBucket = new Bucket(service, 'QueryOutputsBucket', {
+      bucketName: getBucketName('query-outputs', service.props),
+      versioned: false,
+      publicReadAccess: false,
+      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
+      encryption: BucketEncryption.KMS_MANAGED,
+      removalPolicy: RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+    });
+
+    this.workGroup = new CfnWorkGroup(service, 'DataLakeWorkGroup', {
+      name: getResourceName('datalake', service.props),
+      recursiveDeleteOption: true,
+      workGroupConfiguration: {
+        resultConfiguration: {
+          outputLocation: this.athenaOutputBucket.s3UrlForObject(),
+        },
+      },
+    });
+    this.workGroup.applyRemovalPolicy(RemovalPolicy.DESTROY);
+  }
+}

package/prefab/analytics/index.ts

@@ -0,0 +1 @@
+export * from './events';

package/prefab/auth/cognito-pool/index.ts

@@ -0,0 +1,263 @@
+import * as awsCognito from 'aws-cdk-lib/aws-cognito';
+import { CfnOutput, Fn } from 'aws-cdk-lib';
+import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
+import { Key, KeySpec } from 'aws-cdk-lib/aws-kms';
+import { ARecord, HostedZone, RecordTarget } from 'aws-cdk-lib/aws-route53';
+import { UserPoolDomainTarget } from 'aws-cdk-lib/aws-route53-targets';
+import { Construct } from 'constructs';
+
+import { Modifier, ServiceStack, SynthError, getDomain, getLogicalName, getResourceName, getServiceName } from '../../../common';
+
+export type AuthPoolParams = {
+  userPool?: Partial<awsCognito.UserPoolProps>;
+  userPoolClient?: Partial<awsCognito.UserPoolClientProps>;
+  userPoolDomain?: Partial<awsCognito.UserPoolDomainProps>;
+  emailConfiguration?: awsCognito.UserPoolSESOptions;
+  callbackUrl?: string;
+  enableCustomSender?: boolean;
+  socialLogin?: {
+    google?: Omit<awsCognito.UserPoolIdentityProviderGoogleProps, 'userPool'>;
+    facebook?: awsCognito.UserPoolIdentityProviderFacebookProps;
+    apple?: awsCognito.UserPoolIdentityProviderAppleProps;
+  };
+};
+
+export class CognitoAuthPoolPrefab extends Construct {
+  public readonly userPool: awsCognito.UserPool;
+  public readonly userPoolClient: awsCognito.UserPoolClient;
+  public readonly userPoolDomain: awsCognito.UserPoolDomain;
+  public readonly frontendRefs: Record<string, string>;
+  public readonly kmsKey: Key | undefined;
+  public readonly props;
+  // public readonly googleProvider: awsCognito.UserPoolIdentityProviderGoogle | undefined;
+
+  /**
+   * Creates a Cognito UserPool
+   *
+   * @param service - The instance of StackService where the prefab will be deployed
+   * @param params - Prefab params
+   * @returns CognitoAuthPoolPrefab instance
+   */
+  constructor(service: ServiceStack, params: AuthPoolParams) {
+    super(service, getLogicalName(CognitoAuthPoolPrefab.name));
+
+    this.props = service.props;
+
+    //User Pool
+
+    if (params.enableCustomSender) {
+      this.kmsKey = new Key(this, getResourceName('kms', service.props), {
+        keySpec: KeySpec.SYMMETRIC_DEFAULT,
+        alias: getResourceName('kms-alias', service.props),
+        enableKeyRotation: false,
+      });
+
+      this.kmsKey.addToResourcePolicy(
+        new PolicyStatement({
+          actions: ['kms:Encrypt'],
+          effect: Effect.ALLOW,
+          principals: [new ServicePrincipal('cognito-idp.amazonaws.com')],
+          resources: ['*'],
+        })
+      );
+    }
+
+    const defaultUserPoolProps: awsCognito.UserPoolProps = {
+      userPoolName: getResourceName('', service.props),
+      accountRecovery: awsCognito.AccountRecovery.EMAIL_ONLY,
+      selfSignUpEnabled: true,
+      autoVerify: { email: true },
+      signInCaseSensitive: false,
+      passwordPolicy: { minLength: 8, requireDigits: true },
+      customSenderKmsKey: params.enableCustomSender ? this.kmsKey : undefined,
+      email: params.emailConfiguration && awsCognito.UserPoolEmail.withSES(params.emailConfiguration),
+    };
+    const userPool = new awsCognito.UserPool(this, 'UserPool', { ...defaultUserPoolProps, ...params.userPool });
+
+    // Social Login
+    if (params.socialLogin?.google) {
+      const googleProvider = new awsCognito.UserPoolIdentityProviderGoogle(this, 'GoogleProvider', {
+        userPool: userPool,
+        scopes: ['openid', 'email', 'profile'],
+        attributeMapping: {
+          email: awsCognito.ProviderAttribute.GOOGLE_EMAIL,
+          givenName: awsCognito.ProviderAttribute.GOOGLE_GIVEN_NAME,
+          familyName: awsCognito.ProviderAttribute.GOOGLE_FAMILY_NAME,
+        },
+        ...params.socialLogin.google,
+      });
+      userPool.registerIdentityProvider(googleProvider);
+    }
+    if (params.socialLogin?.facebook) {
+      const facebookProvider = new awsCognito.UserPoolIdentityProviderFacebook(this, 'FacebookProvider', params.socialLogin.facebook);
+      userPool.registerIdentityProvider(facebookProvider);
+    }
+    if (params.socialLogin?.apple) {
+      const appleProvider = new awsCognito.UserPoolIdentityProviderApple(this, 'AppleProvider', params.socialLogin.apple);
+      userPool.registerIdentityProvider(appleProvider);
+    }
+
+    // UserPoolClient
+    const callbackUrl = params.callbackUrl || getDomain('app', service.props, true);
+    const defaultUserClientProps: Partial<awsCognito.UserPoolClientProps> = {
+      userPoolClientName: getResourceName('', service.props),
+      authFlows: {
+        custom: true,
+        userSrp: true,
+        userPassword: true,
+        adminUserPassword: false,
+      },
+      oAuth: {
+        flows: {
+          authorizationCodeGrant: true,
+        },
+        callbackUrls: [callbackUrl, ...(service.props.envName === 'dev' ? ['http://localhost:3000'] : [])],
+        logoutUrls: [`${callbackUrl}/sign-in`, ...(service.props.envName === 'dev' ? ['http://localhost:3000/sign-in'] : [])],
+      },
+      preventUserExistenceErrors: true,
+      generateSecret: false,
+    };
+
+    const userPoolClient = new awsCognito.UserPoolClient(this, 'UserPoolClient', {
+      userPool,
+      ...defaultUserClientProps,
+      ...params.userPoolClient,
+    });
+
+    // UserPoolDomain
+    const userPoolDomain = new awsCognito.UserPoolDomain(this, 'UserPoolDomain', {
+      userPool,
+      ...(params.userPoolDomain ? params.userPoolDomain : { cognitoDomain: { domainPrefix: getDomain('auth', service.props).replace(/\./g, '-') } }),
+    });
+
+    if (params.userPoolDomain) {
+      const hostedZone = HostedZone.fromLookup(this, 'HostedZoneEnvDns', { domainName: getDomain('', service.props) });
+      const record = new ARecord(service, 'Record', {
+        zone: hostedZone,
+        target: RecordTarget.fromAlias(new UserPoolDomainTarget(userPoolDomain)),
+        recordName: params.userPoolDomain.customDomain?.domainName,
+      });
+      record.node.addDependency(userPoolDomain);
+    }
+
+    // Attributes and Outputs
+    const userPoolId = userPool.userPoolId;
+    const userPoolClientId = userPoolClient.userPoolClientId;
+    const userPoolDomainUrl = Fn.join('', ['https://', userPoolDomain.domainName, '.auth.us-east-1.amazoncognito.com']);
+    const userPoolRegion = service.props.regionName;
+
+    new CfnOutput(this, 'UserPoolId', { value: userPoolId });
+    new CfnOutput(this, 'UserPoolClientId', { value: userPoolClientId });
+    new CfnOutput(this, 'UserPoolDomainUrl', { value: userPoolDomainUrl });
+    new CfnOutput(this, 'UserPoolRegion', { value: userPoolRegion });
+
+    this.userPool = userPool;
+    this.userPoolClient = userPoolClient;
+    this.userPoolDomain = userPoolDomain;
+    this.frontendRefs = {
+      REACT_APP_COGNITO_USER_POOL_ID: userPoolId,
+      REACT_APP_COGNITO_WEB_CLIENT_ID: userPoolClientId,
+      REACT_APP_COGNITO_DOMAIN: userPoolDomainUrl,
+      REACT_APP_COGNITO_REGION: userPoolRegion,
+    };
+  }
+
+  // MODS
+  public useMod(mods: ((userPool: awsCognito.UserPool) => any)[]): Modifier {
+    return (lambda) => {
+      lambda.addEnvironment('USER_POOL_ID', this.userPool.userPoolId);
+      lambda.addEnvironment('USER_POOL_CLIENT_ID', this.userPoolClient.userPoolClientId);
+      mods.map((fn) => fn(this.userPool)(lambda));
+    };
+  }
+
+  public customSmsSenderMod(): Modifier {
+    return (lambda) => {
+      if (!this.kmsKey) throw new SynthError('enableCustomSender must be true to use customSmsSenderMod');
+
+      lambda.addEnvironment('KEY_ID', this.kmsKey.keyArn);
+      lambda.addEnvironment(
+        'KEY_ALIAS',
+        `arn:aws:kms:${this.props.regionName}:${this.props.deployTarget['services']!.account}:alias/${getServiceName('kms', this.props)}`
+      );
+
+      lambda.role?.addToPrincipalPolicy(
+        new PolicyStatement({
+          actions: [
+            'cognito-idp:AdminConfirmSignUp',
+            'cognito-idp:SignUp',
+            'cognito-idp:InitiateAuth',
+            'cognito-idp:ConfirmSignUp',
+            'cognito-idp:ForgotPassword',
+            'cognito-idp:ConfirmForgotPassword',
+            'cognito-idp:ResendConfirmationCode',
+          ],
+          resources: ['*'],
+        })
+      );
+      lambda.role?.addToPrincipalPolicy(
+        new PolicyStatement({
+          actions: ['kms:Decrypt', 'kms:DescribeKey'],
+          resources: [this.kmsKey.keyArn],
+        })
+      );
+    };
+  }
+
+  public static modifier = {
+    updateUserAtt: (): Modifier => {
+      return (lambda) => {
+        lambda.role?.addToPrincipalPolicy(
+          new PolicyStatement({
+            actions: ['cognito-idp:AdminUpdateUserAttributes', 'cognito-idp:AdminDisableUser', 'cognito-idp:AdminEnableUser'],
+            resources: ['*'],
+          })
+        );
+      };
+    },
+    deleteUser: (): Modifier => {
+      return (lambda) => {
+        lambda.role?.addToPrincipalPolicy(
+          new PolicyStatement({
+            actions: ['cognito-idp:AdminDeleteUser'],
+            resources: ['*'],
+          })
+        );
+      };
+    },
+    preSignUp: (): Modifier => {
+      return (lambda) => {
+        lambda.role?.addToPrincipalPolicy(
+          new PolicyStatement({
+            actions: [
+              'cognito-idp:AdminLinkProviderForUser',
+              'cognito-idp:AdminGetUser',
+              'cognito-idp:AdminCreateUser',
+              'cognito-idp:AdminSetUserPassword',
+              'cognito-idp:AdminUpdateUserAttributes',
+            ],
+            resources: ['*'],
+          })
+        );
+      };
+    },
+    authUser: (): Modifier => {
+      return (lambda) => {
+        lambda.role?.addToPrincipalPolicy(
+          new PolicyStatement({
+            actions: [
+              'cognito-idp:AdminConfirmSignUp',
+              'cognito-idp:SignUp',
+              'cognito-idp:InitiateAuth',
+              'cognito-idp:ConfirmSignUp',
+              'cognito-idp:ForgotPassword',
+              'cognito-idp:ConfirmForgotPassword',
+              'cognito-idp:ResendConfirmationCode',
+            ],
+            resources: ['*'],
+          })
+        );
+      };
+    },
+  };
+}

package/prefab/auth/index.ts

@@ -0,0 +1 @@
+export * from './cognito-pool';