问无服务器框架-将Cognito用户池配置为通过SES发送电子邮件

EN

service: cognito

provider:
name: aws
runtime: nodejs12.x
region: us-west-2
stage: prod
memorySize: 128
timeout: 5
endpointType: regional

Resources:
    # Creates a role that allows Cognito to send SNS messages
    SNSRole:
    Type: "AWS::IAM::Role"
    Properties:
        AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement:
            - Effect: "Allow"
            Principal: 
                Service: 
                - "cognito-idp.amazonaws.com"
            Action: 
                - "sts:AssumeRole"
        Policies:
        - PolicyName: "CognitoSNSPolicy"
            PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
                - Effect: "Allow"
                Action: "sns:publish"
                Resource: "*"

    # Creates a user pool in cognito for your app to auth against
    UserPool:
    Type: AWS::Cognito::UserPool
        DeletionPolicy: Retain
        Properties:
        UserPoolName: MyUserPool
        AutoVerifiedAttributes:
            - email
        Policies:
            PasswordPolicy:
            MinimumLength: 8
            RequireLowercase: true
            RequireNumbers: true
            RequireSymbols: false
            RequireUppercase: true
        UsernameAttributes:
            - email

    # Creates a User Pool Client to be used by the identity pool
    UserPoolClient:
    Type: "AWS::Cognito::UserPoolClient"
    Properties:
        ClientName: !Sub ${AuthName}-client
        GenerateSecret: false
        UserPoolId: !Ref UserPool

    # Creates a federeated Identity pool
    IdentityPool:
    Type: "AWS::Cognito::IdentityPool"
    Properties:
        IdentityPoolName: !Sub ${AuthName}Identity
        AllowUnauthenticatedIdentities: true
        CognitoIdentityProviders: 
        - ClientId: !Ref UserPoolClient
            ProviderName: !GetAtt UserPool.ProviderName

    # Create a role for unauthorized acces to AWS resources. Very limited access. Only allows users in the previously created Identity Pool
    CognitoUnAuthorizedRole:
    Type: "AWS::IAM::Role"
    Properties:
        AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement:
            - Effect: "Allow"
            Principal: 
                Federated: "cognito-identity.amazonaws.com"
            Action: 
                - "sts:AssumeRoleWithWebIdentity"
            Condition:
                StringEquals: 
                "cognito-identity.amazonaws.com:aud": !Ref IdentityPool
                "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": unauthenticated
        Policies:
        - PolicyName: "CognitoUnauthorizedPolicy"
            PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
                - Effect: "Allow"
                Action:
                    - "mobileanalytics:PutEvents"
                    - "cognito-sync:*"
                Resource: "*"

    # Create a role for authorized acces to AWS resources. Control what your user can access. This example only allows Lambda invokation
    # Only allows users in the previously created Identity Pool
    CognitoAuthorizedRole:
    Type: "AWS::IAM::Role"
    Properties:
        AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement:
            - Effect: "Allow"
            Principal: 
                Federated: "cognito-identity.amazonaws.com"
            Action: 
                - "sts:AssumeRoleWithWebIdentity"
            Condition:
                StringEquals: 
                "cognito-identity.amazonaws.com:aud": !Ref IdentityPool
                "ForAnyValue:StringLike":
                "cognito-identity.amazonaws.com:amr": authenticated
        Policies:
        - PolicyName: "CognitoAuthorizedPolicy"
            PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
                - Effect: "Allow"
                Action:
                    - "mobileanalytics:PutEvents"
                    - "cognito-sync:*"
                    - "cognito-identity:*"
                Resource: "*"
                - Effect: "Allow"
                Action:
                    - "lambda:InvokeFunction"
                Resource: "*"

    # Assigns the roles to the Identity Pool
    IdentityPoolRoleMapping:
    Type: "AWS::Cognito::IdentityPoolRoleAttachment"
    Properties:
        IdentityPoolId: !Ref IdentityPool
        Roles:
        authenticated: !GetAtt CognitoAuthorizedRole.Arn
        unauthenticated: !GetAtt CognitoUnAuthorizedRole.Arn

Outputs:
    UserPoolId:
    Value: !Ref UserPool
    Export:
        Name: "UserPool::Id"
    UserPoolClientId:
    Value: !Ref UserPoolClient
    Export:
        Name: "UserPoolClient::Id"
    IdentityPoolId:
    Value: !Ref IdentityPool
    Export:
        Name: "IdentityPool::Id"