无法创建 AWS Cognito 身份池答案

【问题标题】：Cannot create AWS Cognito Identity Pool无法创建 AWS Cognito 身份池
【发布时间】：2019-10-31 06:13:38
【问题描述】：

我正在尝试创建一个堆栈，该堆栈将创建一个用户池及其应用程序客户端和身份池。这是堆栈：

{
    "AWSTemplateFormatVersion": "2010-09-09",
 
    "Parameters" : {
        "CognitoUserPoolName": {
            "Description": "Name of the Cognito user pool as a parameter passed into this template.",
            "Type": "String"
        }
    },

    "Resources": {
        "UserPool": {
            "Type": "AWS::Cognito::UserPool",
            "Properties": {
                "UserPoolName" : {
                    "Ref": "CognitoUserPoolName"
                },
                "Policies": {
                    "PasswordPolicy": {
                        "MinimumLength": 8,
                        "RequireUppercase": true,
                        "RequireLowercase": true,
                        "RequireNumbers": true,
                        "RequireSymbols": true
                    }
                },
                "Schema": [
                    {
                        "Name": "name",
                        "AttributeDataType": "String",
                        "Mutable": true,
                        "Required": false
                    },
                    {
                        "Name": "email",
                        "AttributeDataType": "String",
                        "Mutable": false,
                        "Required": true
                    },
                    {
                        "Name": "phone_number",
                        "AttributeDataType": "String",
                        "Mutable": false,
                        "Required": false
                    }
                ],
                "LambdaConfig": {},
                "AutoVerifiedAttributes": [
                    "email"
                ],
                "UsernameAttributes": [
                    "email"
                ],
                "SmsVerificationMessage": "Your verification code is {####}. ",
                "EmailVerificationMessage": "Your app verification code is {####}. ",
                "EmailVerificationSubject": "Your app verification code",
                "SmsAuthenticationMessage": "Your authentication code is {####}. ",
                "MfaConfiguration": "OFF",
                "EmailConfiguration": {},
                "UserPoolTags": {},
                "AdminCreateUserConfig": {
                    "AllowAdminCreateUserOnly": false,
                    "UnusedAccountValidityDays": 7,
                    "InviteMessageTemplate": {
                        "SMSMessage": "Your username is {username} and temporary password is {####}. ",
                        "EmailMessage": "Your username is {username} and temporary password is {####}. ",
                        "EmailSubject": "Your temporary password"
                    }
                }         
            }
        },
        "UserPoolClient": {
            "Type": "AWS::Cognito::UserPoolClient",
            "Description": "App Client.",
            "DependsOn": "UserPool",
            "Properties": {
                "ClientName": {
                    "Fn::Sub": "${CognitoUserPoolName}Client"
                },
                "ExplicitAuthFlows": [
                    "ADMIN_NO_SRP_AUTH"
                ],
                "GenerateSecret": false,
                "RefreshTokenValidity": 30,
                "UserPoolId": {
                    "Ref": "UserPool"
                }
            }
        },
        "IdentityPool": {
            "Type" : "AWS::Cognito::IdentityPool",
            "DependsOn": ["UserPool", "UserPoolClient"],
            "Properties" : {
                "AllowUnauthenticatedIdentities" : false,
                "CognitoIdentityProviders" : [
                    {
                        "ClientId": {
                            "Ref": "UserPool"
                        },
                        "ProviderName": {
                            "Fn::GetAtt": [
                                "UserPool",
                                "Arn"
                            ]
                        }
                    }
                ],
                "IdentityPoolName" : {
                    "Fn::Sub": "${CognitoUserPoolName}IdentityPool"
                }
            }
        }
    },
    "Outputs": {
        "UserPoolARN": {
            "Value": {
                "Fn::GetAtt": [
                    "UserPool",
                    "Arn"
                ]
            }
        }
    }
}

我不断收到此错误：

dentityPool CREATE_FAILED   1 validation error detected: Value 'us-east-1_<>' at 'cognitoIdentityProviders.1.member.clientId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\w_]+ (Service: AmazonCognitoIdentity; Status Code: 400; Error Code: ValidationException; Request ID: <>)

User Pool ID 的格式似乎不正确。

我尝试像这样编辑CognitoIdentityProviders：

"CognitoIdentityProviders" : [
                    {
                        "ClientId": {
                            "Ref": "UserPool"
                        }
                    },
                    {
                        "ClientId": {
                            "Ref": "UserPoolClient"
                        }
                    }
                ],

但我不断收到同样的错误。我之前使用控制台创建了一个身份池，你应该同时添加User Pool ID和App Client ID，而User Pool ID的格式为us-east-1-1_string。

6 月 18 日更新

按照下面 jens 的回答，我能够创建身份池。但是，User Pool ID 和 App client id 都具有 User Pool ID 的值：us-east-1-1_string。

我尝试添加另一个这样的提供商：

"ClientId": {
    "Ref": "UserPoolClient"
},
"ProviderName": {
    "Fn::GetAtt": [
        "UserPool",
        "ProviderName"
    ]
}

它确实创建了正确的提供者：

User Pool ID：us-east-1-1_string。例如：us-east-1_Ab129faBb
App client id：string。例如：7lhlkkfbfb4q5kpp90urffao

但是提供者有重复。我试过了
将App client id，Provider 名称改为UserPoolClient，但创建失败。
删除App client id的ProviderName但创建失败。

【问题讨论】：

标签： amazon-web-services amazon-cloudformation amazon-cognito

【解决方案1】：

非常感谢上面@jens 的回答。它确实奏效了，尽管在我的更新中上面提到的App client id 存在问题，但它确实帮助我找出了正确的模板。

我已经找到了编写模板的正确方法：

"CognitoIdentityProviders": [
    {
        "ClientId": {
            "Ref": "UserPoolClient"
        },
        "ProviderName": {
            "Fn::GetAtt": [
                "UserPool",
                "ProviderName"
            ]
        }
    }
],

这样，堆栈会正确创建Identity Pool。 The AWS docs 令人困惑：

提供者名称 Amazon Cognito 用户池的提供商名称。例如，cognito-idp.us-east-2.amazonaws.com/us-east-2_123456789。

【讨论】：

【解决方案2】：

这似乎是 CloudFormation 实现中的一个错误。

如果您将 ClientID 从 us-east-1-1_string 更改为 us_east_1_1_string，则会构建模板，并且 UI 会显示正确的原始字符串（带有破折号）。

由于 CloudFormation 也没有替换功能，替换字符串的唯一方法是拆分并重新连接字符串部分。

因此，对于 3 个破折号，您需要以下构造：

"ClientId": {
  "Fn::Join": ["_",
    [{"Fn::Select": ["0",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
    {"Fn::Select": ["1",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
    {"Fn::Select": ["2",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
    {"Fn::Select": ["3",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]}
    ] 
  ]
}

我尝试执行您的模板，它总是为我生成一个带有 2 个破折号的字符串。所以对于两个破折号版本，这将是完整的模板：

{
    "AWSTemplateFormatVersion": "2010-09-09",

    "Parameters": {
        "CognitoUserPoolName": {
            "Description": "Name of the Cognito user pool as a parameter passed into this template.",
            "Type": "String"
        }
    },

    "Resources": {
        "UserPool": {
            "Type": "AWS::Cognito::UserPool",
            "Properties": {
                "UserPoolName": {
                    "Ref": "CognitoUserPoolName"
                },
                "Policies": {
                    "PasswordPolicy": {
                        "MinimumLength": 8,
                        "RequireUppercase": true,
                        "RequireLowercase": true,
                        "RequireNumbers": true,
                        "RequireSymbols": true
                    }
                },
                "Schema": [{
                        "Name": "name",
                        "AttributeDataType": "String",
                        "Mutable": true,
                        "Required": false
                    },
                    {
                        "Name": "email",
                        "AttributeDataType": "String",
                        "Mutable": false,
                        "Required": true
                    },
                    {
                        "Name": "phone_number",
                        "AttributeDataType": "String",
                        "Mutable": false,
                        "Required": false
                    }
                ],
                "LambdaConfig": {},
                "AutoVerifiedAttributes": [
                    "email"
                ],
                "UsernameAttributes": [
                    "email"
                ],
                "SmsVerificationMessage": "Your verification code is {####}. ",
                "EmailVerificationMessage": "Your app verification code is {####}. ",
                "EmailVerificationSubject": "Your app verification code",
                "SmsAuthenticationMessage": "Your authentication code is {####}. ",
                "MfaConfiguration": "OFF",
                "EmailConfiguration": {},
                "UserPoolTags": {},
                "AdminCreateUserConfig": {
                    "AllowAdminCreateUserOnly": false,
                    "UnusedAccountValidityDays": 7,
                    "InviteMessageTemplate": {
                        "SMSMessage": "Your username is {username} and temporary password is {####}. ",
                        "EmailMessage": "Your username is {username} and temporary password is {####}. ",
                        "EmailSubject": "Your temporary password"
                    }
                }
            }
        },
        "UserPoolClient": {
            "Type": "AWS::Cognito::UserPoolClient",
            "Description": "App Client.",
            "DependsOn": "UserPool",
            "Properties": {
                "ClientName": {
                    "Fn::Sub": "${CognitoUserPoolName}Client"
                },
                "ExplicitAuthFlows": [
                    "ADMIN_NO_SRP_AUTH"
                ],
                "GenerateSecret": false,
                "RefreshTokenValidity": 30,
                "UserPoolId": {
                    "Ref": "UserPool"
                }
            }
        },
        "IdentityPool": {
            "Type": "AWS::Cognito::IdentityPool",
            "DependsOn": ["UserPool", "UserPoolClient"],
            "Properties": {
                "AllowUnauthenticatedIdentities": false,
                "CognitoIdentityProviders": [{
                    "ClientId": {
                      "Fn::Join": [
                        "_",
                        [
                            {
                                "Fn::Select": [
                                    "0",
                                    {
                                        "Fn::Split": [
                                            "-",
                                            {
                                                "Ref": "UserPool"
                                            }
                                        ]
                                    }
                                ]
                            },
                            {
                                "Fn::Select": [
                                    "1",
                                    {
                                        "Fn::Split": [
                                            "-",
                                            {
                                                "Ref": "UserPool"
                                            }
                                        ]
                                    }
                                ]
                            },
                            {
                                "Fn::Select": [
                                    "2",
                                    {
                                        "Fn::Split": [
                                            "-",
                                            {
                                                "Ref": "UserPool"
                                            }
                                        ]
                                    }
                                ]
                            }
                        ]
                    ]
                    },
                    "ProviderName": {
                        "Fn::GetAtt": [
                            "UserPool",
                            "ProviderName"
                        ]
                    }
                }],
                "IdentityPoolName": {
                    "Fn::Sub": "${CognitoUserPoolName}IdentityPool"
                }
            }
        }
    },
    "Outputs": {
        "UserPoolARN": {
            "Value": {
                "Fn::GetAtt": [
                    "UserPool",
                    "Arn"
                ]
            }
        }
    }
}

【讨论】：

非常感谢@jens。太奇怪了，在他们的文档中，他们根本没有提到这一点以及为什么应该这样："ProviderName": { "Fn::GetAtt": [ "UserPool", "ProviderName" ] }
其实你的答案就差不多了。我会更新我的问题