Cognito: Passwordless authentication support

[ataylorme]

Describe the feature

Support Cognito managed passwordless login as described in this doc

Use Case

I would like to configure Cognito to manage passwordless authentication in my AWS CDK project.

I am stuck on the PoliciesProperty not supporting SignInPolicy

This type is generated from the CloudFormation user pools policy type which is in turn generated from the create user pool request

The create user pool request type is updated but the generated CloudFormation and CDK types stemming from it are not updated.

This seems to be a new feature released on November 22nd, 2024.

I expect auto generated types to be updated 24 hours later.

Proposed Solution

Update Cognito CDK to support the new Congito passwordless authentication features.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

NodeJS aws-cdk-lib 2.170.0

Environment details (OS name and version, etc.)

Node 22

[ataylorme]

I might be missing something in the chain that goes from Cognito API requests to CDK. It looks like the AWS JavaScript SDK method for createUserPool doesn't have the passwordless fields either

I can create things in the console but this negates the benefits of Infrastructure as Code

[pahud]

Thank you for your feature request. To support that, we'll first need CloudFormation support.

Just checked https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-policies.html but unfortunately I can't find relevant support.

Please help the CFN team prioritize by create a feature request at cloudformation-coverage-roadmap, as soon as CFN rolls out the support, CDK should be ready to get it supported as well.

[ataylorme]

I opened #2200 there but I would request that AWS collaborate on support across teams internally.

The burden for starting the process of updating CloudFormation and CDK after Cognito API changes shouldn't fall to users. If anything, AWS can improve internal collaboration so support is launched along side new features, not lagging behind

[BwL1289]

+1. Adding a link to https://github.com/aws-samples/amazon-cognito-passwordless-auth/blob/main/cdk/lib/cognito-passwordless.ts for more context.

[Tietew]

CloudFormation support seems to be shipped.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-signinpolicy.html

L1 construct will be updated in a few days.

[BwL1289]

Once L1 is merged, any ETA on L2 release?

[alexbaileyuk]

Here is an escape hatch until the PR for the L2 construct is merged written for TS:

// Escape hatch for https://github.com/aws/aws-cdk/issues/32265
const cfnPool = userPool.node.defaultChild as CfnUserPool;
cfnPool.policies = {
  ...cfnPool.policies,
  signInPolicy: {
    allowedFirstAuthFactors: ['PASSWORD', 'EMAIL_OTP'],
  }
}

[BwL1289]

@alexbaileyuk don't we need WEB_AUTHN as well?: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-signinpolicy.html#cfn-cognito-userpool-signinpolicy-allowedfirstauthfactors

[BwL1289]

FWIW, in implementing the above I'm seeing: E3002 Additional properties are not allowed ('SignInPolicy' was unexpected) in CfnLint, which is strange because it's clear that's a property that Cfn expects: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolPolicyType.html#CognitoUserPools-Type-UserPoolPolicyType-SignInPolicy.

...
Policies:
  PasswordPolicy:
    ...
  SignInPolicy:
    AllowedFirstAuthFactors:
     ...

LMK if anyone has any ideas

[alexbaileyuk]

@alexbaileyuk don't we need WEB_AUTHN as well?: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-signinpolicy.html#cfn-cognito-userpool-signinpolicy-allowedfirstauthfactors

@BwL1289 As far as I'm aware, webauthn is for pass key authentication so if you need that feature, then you should enable it. I'm not seeing that error on the CDK version I am using. Have you tried updating to the latest version?

[BwL1289]

@alexbaileyuk thanks - you're correct. Re E3002 Additional properties are not allowed ('SignInPolicy' was unexpected), this was resolved with an upgrade in cfnlint to latest. Cheers!

[mcetat]

Have the aws cdk samples been updated with an example of that? I can't seem to locate it.
Does anyone have a basic example I could use as a starting point?

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.