fix(cognito-identitypool-alpha): cannot configure roleMappings with imported userPool and client

packages/@aws-cdk/aws-cognito-identitypool-alpha/lib/identitypool.ts

@@ -1,7 +1,7 @@
 import {
   CfnIdentityPool,
-  UserPool,
-  UserPoolClient,
+  IUserPool,
+  IUserPoolClient,
 } from 'aws-cdk-lib/aws-cognito';
 import {
   IOpenIdConnectProvider,
@@ -158,7 +158,7 @@ export class IdentityPoolProviderUrl {
   }
 
   /** User Pool Provider Url */
-  public static userPool(userPool: UserPool, userPoolClient: UserPoolClient): IdentityPoolProviderUrl {
+  public static userPool(userPool: IUserPool, userPoolClient: IUserPoolClient): IdentityPoolProviderUrl {
     const url = `${userPool.userPoolProviderName}:${userPoolClient.userPoolClientId}`;
     return new IdentityPoolProviderUrl(IdentityPoolProviderType.USER_POOL, url);
   }

packages/@aws-cdk/aws-cognito-identitypool-alpha/test/identitypool.test.ts

@@ -3,6 +3,7 @@ import {
 } from 'aws-cdk-lib/assertions';
 import {
   UserPool,
+  UserPoolClient,
   UserPoolIdentityProvider,
 } from 'aws-cdk-lib/aws-cognito';
 import {
@@ -728,4 +729,39 @@ describe('role mappings', () => {
       },
     });
   });
+
+  test('role mapping with an imported user pool and client', () => {
+    const stack = new Stack();
+    const importedPool = UserPool.fromUserPoolArn(stack, 'ImportedPool', 'arn:aws:cognito-idp:us-east-1:0123456789012:userpool/test-user-pool');
+    const importedClient = UserPoolClient.fromUserPoolClientId(stack, 'ImportedPoolClient', 'client-id');
+    new IdentityPool(stack, 'TestIdentityPoolRoleMappingRules', {
+      roleMappings: [{
+        mappingKey: 'cognito',
+        providerUrl: IdentityPoolProviderUrl.userPool(importedPool, importedClient),
+        useToken: true,
+      }],
+    });
+    const temp = Template.fromStack(stack);
+    temp.resourceCountIs('AWS::Cognito::IdentityPoolRoleAttachment', 1);
+    temp.hasResourceProperties('AWS::Cognito::IdentityPoolRoleAttachment', {
+      IdentityPoolId: {
+        Ref: 'TestIdentityPoolRoleMappingRulesC8C07BC3',
+      },
+      RoleMappings: {
+        cognito: {
+          IdentityProvider: {
+            'Fn::Join': [
+              '',
+              [
+                'cognito-idp.us-east-1.',
+                { Ref: 'AWS::URLSuffix' },
+                '/test-user-pool:client-id',
+              ],
+            ],
+          },
+          Type: 'Token',
+        },
+      },
+    });
+  });
 });

packages/@aws-cdk/aws-cognito-identitypool-alpha/test/integ.identitypool.ts

@@ -3,6 +3,7 @@ import {
   UserPoolIdentityProviderGoogle,
   UserPoolIdentityProviderAmazon,
   ProviderAttribute,
+  UserPoolClient,
 } from 'aws-cdk-lib/aws-cognito';
 import {
   Effect,
@@ -52,10 +53,15 @@ new UserPoolIdentityProviderAmazon(stack, 'OtherPoolProviderAmazon', {
   },
 });
 const client = userPool.addClient('testClient');
+const userPoolToImport = new UserPool(stack, 'UserPoolToImport');
+const clientToImport = userPoolToImport.addClient('clientToImport');
+const importedUserPool = UserPool.fromUserPoolArn(stack, 'ImportedUserPool', userPoolToImport.userPoolArn);
+const importedUserPoolClient = UserPoolClient.fromUserPoolClientId(stack, 'ImportedUserPoolClient', clientToImport.userPoolClientId);
 const provider = new UserPoolAuthenticationProvider({ userPool, userPoolClient: client });
+const importedProvider = new UserPoolAuthenticationProvider({ userPool: importedUserPool, userPoolClient: importedUserPoolClient });
 const idPool = new IdentityPool(stack, 'identitypool', {
   authenticationProviders: {
-    userPools: [provider],
+    userPools: [provider, importedProvider],
     amazon: { appId: 'amzn1.application.12312k3j234j13rjiwuenf' },
     google: { clientId: '12345678012.apps.googleusercontent.com' },
   },
@@ -65,6 +71,11 @@ const idPool = new IdentityPool(stack, 'identitypool', {
       providerUrl: IdentityPoolProviderUrl.userPool(userPool, client),
       useToken: true,
     },
+    {
+      mappingKey: 'importedUserPool',
+      providerUrl: IdentityPoolProviderUrl.userPool(importedUserPool, importedUserPoolClient),
+      useToken: true,
+    },
   ],
   allowClassicFlow: true,
   identityPoolName: 'my-id-pool',

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

@@ -767,6 +767,12 @@ export interface IUserPool extends IResource {
    */
   readonly userPoolArn: string;
 
+  /**
+   * The provider name of this user pool resource
+   * @attribute
+   */
+  readonly userPoolProviderName: string;
+
   /**
    * Get all identity providers registered with this user pool.
    */
@@ -805,6 +811,7 @@ export interface IUserPool extends IResource {
 abstract class UserPoolBase extends Resource implements IUserPool {
   public abstract readonly userPoolId: string;
   public abstract readonly userPoolArn: string;
+  public abstract readonly userPoolProviderName: string;
   public readonly identityProviders: IUserPoolIdentityProvider[] = [];
 
   public addClient(id: string, options?: UserPoolClientOptions): UserPoolClient {
@@ -870,10 +877,14 @@ export class UserPool extends UserPoolBase {
     }
 
     const userPoolId = arnParts.resourceName;
+    // ex) cognito-idp.us-east-1.amazonaws.com/us-east-1_abcdefghi
+    const providerName = `cognito-idp.${arnParts.region}.${Stack.of(scope).urlSuffix}/${userPoolId}`;;
 
     class ImportedUserPool extends UserPoolBase {
       public readonly userPoolArn = userPoolArn;
       public readonly userPoolId = userPoolId;
+      public readonly userPoolProviderName = providerName;
+
       constructor() {
         super(scope, id, {
           account: arnParts.account,

packages/aws-cdk-lib/aws-cognito/test/user-pool.test.ts

@@ -300,6 +300,9 @@ describe('User Pool', () => {
     const pool = UserPool.fromUserPoolArn(stack, 'userpool', userPoolArn);
     expect(pool.userPoolId).toEqual('test-user-pool');
     expect(stack.resolve(pool.userPoolArn)).toEqual('arn:aws:cognito-idp:us-east-1:0123456789012:userpool/test-user-pool');
+    expect(stack.resolve(pool.userPoolProviderName)).toEqual(
+      { 'Fn::Join': ['', ['cognito-idp.us-east-1.', { Ref: 'AWS::URLSuffix' }, '/test-user-pool']] },
+    );
   });
 
   test('import using arn without resourceName fails', () => {