Amazon Cognito

import * as aws from "@pulumi/aws";
import * as cognito from "@pulumi/aws/cognito";

const userPool = new aws.cognito.UserPool("user-pool", {
    name: "my-user-pool",
    autoVerifiedAttributes: ["email"],
    passwordPolicy: {
        minimumLength: 8,
        requireLowercase: true,
        requireNumbers: true,
        requireSymbols: true,
        requireUppercase: true,
    },
    schemas: [{
        name: "email",
        attributeDataType: "String",
        required: true,
        mutable: false,
    }],
});

const userPoolClient = new aws.cognito.UserPoolClient("user-pool-client", {
    name: "my-app-client",
    userPoolId: userPool.id,
    generateSecret: false,
    explicitAuthFlows: [
        "ALLOW_USER_PASSWORD_AUTH",
        "ALLOW_REFRESH_TOKEN_AUTH",
    ],
});

const identityPool = new aws.cognito.IdentityPool("identity-pool", {
    identityPoolName: "my-identity-pool",
    allowUnauthenticatedIdentities: false,
    cognitoIdentityProviders: [{
        clientId: userPoolClient.id,
        providerName: userPool.endpoint,
    }],
});

const userPool = new aws.cognito.UserPool("mfa-pool", {
    name: "mfa-user-pool",
    mfaConfiguration: "OPTIONAL",
    softwareTokenMfaConfiguration: {
        enabled: true,
    },
    smsConfiguration: {
        externalId: "my-external-id",
        snsCallerArn: snsRole.arn,
    },
});

const userPool = new aws.cognito.UserPool("verified-pool", {
    name: "verified-user-pool",
    autoVerifiedAttributes: ["email"],
    verificationMessageTemplate: {
        defaultEmailOption: "CONFIRM_WITH_CODE",
        emailMessage: "Your verification code is {####}",
        emailSubject: "Verify your email",
    },
    emailConfiguration: {
        emailSendingAccount: "COGNITO_DEFAULT",
    },
});

const authenticatedRole = new aws.iam.Role("authenticated", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                Federated: "cognito-identity.amazonaws.com",
            },
            Action: "sts:AssumeRoleWithWebIdentity",
            Condition: {
                StringEquals: {
                    "cognito-identity.amazonaws.com:aud": identityPool.id,
                },
                "ForAnyValue:StringLike": {
                    "cognito-identity.amazonaws.com:amr": "authenticated",
                },
            },
        }],
    }),
});

new aws.cognito.IdentityPoolRoleAttachment("roles", {
    identityPoolId: identityPool.id,
    roles: {
        authenticated: authenticatedRole.arn,
    },
});