From 995e32308bacb826051a68cfb9335518d532f66d Mon Sep 17 00:00:00 2001
From: David Steiner <david_j_steiner@yahoo.co.nz>
Date: Thu, 27 Jul 2023 22:18:14 +0100
Subject: [PATCH] Add custom CSS and logo for Cognito hosted UI

---
 .gitignore                                    |   1 +
 .pre-commit-config.yaml                       |   1 +
 infrastructure/custom_resources/__init__.py   |   0
 .../custom_resources/crhelper/__init__.py     |   1 +
 .../custom_resources/crhelper/log_helper.py   |  79 ++++
 .../crhelper/resource_helper.py               | 374 ++++++++++++++++++
 .../custom_resources/crhelper/utils.py        |  61 +++
 infrastructure/custom_resources/hosted_ui.py  |  79 ++++
 infrastructure/hosted_ui.py                   | 109 +++++
 infrastructure/hosted_ui_assets/cognito.css   |  43 ++
 infrastructure/hosted_ui_assets/logo.png      | Bin 0 -> 14800 bytes
 infrastructure/user_pool.py                   |   5 +
 pyproject.toml                                |   4 +-
 13 files changed, 756 insertions(+), 1 deletion(-)
 create mode 100644 infrastructure/custom_resources/__init__.py
 create mode 100644 infrastructure/custom_resources/crhelper/__init__.py
 create mode 100644 infrastructure/custom_resources/crhelper/log_helper.py
 create mode 100644 infrastructure/custom_resources/crhelper/resource_helper.py
 create mode 100644 infrastructure/custom_resources/crhelper/utils.py
 create mode 100644 infrastructure/custom_resources/hosted_ui.py
 create mode 100644 infrastructure/hosted_ui.py
 create mode 100644 infrastructure/hosted_ui_assets/cognito.css
 create mode 100644 infrastructure/hosted_ui_assets/logo.png

diff --git a/.gitignore b/.gitignore
index c2109c6..7475d1e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@ deploy.sh
 update-code.sh
 infrastructure/.env
 docker/dynamodb
+**/.DS_Store
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e8dbc95..beec5cd 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -26,6 +26,7 @@ repos:
     rev: v1.4.1
     hooks:
       - id: mypy
+        exclude: "^infrastructure/custom_resources/"
   - repo: local
     hooks:
       - id: rust-linting
diff --git a/infrastructure/custom_resources/__init__.py b/infrastructure/custom_resources/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/infrastructure/custom_resources/crhelper/__init__.py b/infrastructure/custom_resources/crhelper/__init__.py
new file mode 100644
index 0000000..971d4b7
--- /dev/null
+++ b/infrastructure/custom_resources/crhelper/__init__.py
@@ -0,0 +1 @@
+from crhelper.resource_helper import FAILED, SUCCESS, CfnResource
diff --git a/infrastructure/custom_resources/crhelper/log_helper.py b/infrastructure/custom_resources/crhelper/log_helper.py
new file mode 100644
index 0000000..d206444
--- /dev/null
+++ b/infrastructure/custom_resources/crhelper/log_helper.py
@@ -0,0 +1,79 @@
+from __future__ import print_function
+
+import json
+import logging
+
+
+def _json_formatter(obj):
+    """Formatter for unserialisable values."""
+    return str(obj)
+
+
+class JsonFormatter(logging.Formatter):
+    """AWS Lambda Logging formatter.
+
+    Formats the log message as a JSON encoded string.  If the message is a
+    dict it will be used directly.  If the message can be parsed as JSON, then
+    the parse d value is used in the output record.
+    """
+
+    def __init__(self, **kwargs):
+        super(JsonFormatter, self).__init__()
+        self.format_dict = {
+            "timestamp": "%(asctime)s",
+            "level": "%(levelname)s",
+            "location": "%(name)s.%(funcName)s:%(lineno)d",
+        }
+        self.format_dict.update(kwargs)
+        self.default_json_formatter = kwargs.pop("json_default", _json_formatter)
+
+    def format(self, record):
+        record_dict = record.__dict__.copy()
+        record_dict["asctime"] = self.formatTime(record)
+
+        log_dict = {k: v % record_dict for k, v in self.format_dict.items() if v}
+
+        if isinstance(record_dict["msg"], dict):
+            log_dict["message"] = record_dict["msg"]
+        else:
+            log_dict["message"] = record.getMessage()
+
+            # Attempt to decode the message as JSON, if so, merge it with the
+            # overall message for clarity.
+            try:
+                log_dict["message"] = json.loads(log_dict["message"])
+            except (TypeError, ValueError):
+                pass
+
+        if record.exc_info:
+            # Cache the traceback text to avoid converting it multiple times
+            # (it's constant anyway)
+            # from logging.Formatter:format
+            if not record.exc_text:
+                record.exc_text = self.formatException(record.exc_info)
+
+        if record.exc_text:
+            log_dict["exception"] = record.exc_text
+
+        json_record = json.dumps(log_dict, default=self.default_json_formatter)
+
+        if hasattr(json_record, "decode"):  # pragma: no cover
+            json_record = json_record.decode("utf-8")
+
+        return json_record
+
+
+def setup(level="DEBUG", formatter_cls=JsonFormatter, boto_level=None, **kwargs):
+    if formatter_cls:
+        for handler in logging.root.handlers:
+            handler.setFormatter(formatter_cls(**kwargs))
+
+    logging.root.setLevel(level)
+
+    if not boto_level:
+        boto_level = level
+
+    logging.getLogger("boto").setLevel(boto_level)
+    logging.getLogger("boto3").setLevel(boto_level)
+    logging.getLogger("botocore").setLevel(boto_level)
+    logging.getLogger("urllib3").setLevel(boto_level)
diff --git a/infrastructure/custom_resources/crhelper/resource_helper.py b/infrastructure/custom_resources/crhelper/resource_helper.py
new file mode 100644
index 0000000..88d6cc0
--- /dev/null
+++ b/infrastructure/custom_resources/crhelper/resource_helper.py
@@ -0,0 +1,374 @@
+# -*- coding: utf-8 -*-
+"""
+TODO:
+* Async mode – take a wait condition handle as an input, increases max timeout to 12 hours
+* Idempotency – If a duplicate request comes in (say there was a network error in signaling back to cfn) the subsequent
+  request should return the already created response, will need a persistent store of some kind...
+* Functional tests
+"""
+
+from __future__ import print_function
+
+import json
+import logging
+import os
+import random
+import string
+import threading
+from time import sleep
+
+import boto3
+from crhelper import log_helper
+from crhelper.utils import _send_response
+
+logger = logging.getLogger(__name__)
+
+SUCCESS = "SUCCESS"
+FAILED = "FAILED"
+
+
+class CfnResource(object):
+    def __init__(
+        self,
+        json_logging=False,
+        log_level="DEBUG",
+        boto_level="ERROR",
+        polling_interval=2,
+        sleep_on_delete=120,
+        ssl_verify=None,
+    ):
+        self._sleep_on_delete = sleep_on_delete
+        self._create_func = None
+        self._update_func = None
+        self._delete_func = None
+        self._poll_create_func = None
+        self._poll_update_func = None
+        self._poll_delete_func = None
+        self._timer = None
+        self._init_failed = None
+        self._json_logging = json_logging
+        self._log_level = log_level
+        self._boto_level = boto_level
+        self._send_response = False
+        self._polling_interval = polling_interval
+        self.Status = ""
+        self.Reason = ""
+        self.PhysicalResourceId = ""
+        self.StackId = ""
+        self.RequestId = ""
+        self.LogicalResourceId = ""
+        self.Data = {}
+        self.NoEcho = False
+        self._event = {}
+        self._context = None
+        self._response_url = ""
+        self._sam_local = os.getenv("AWS_SAM_LOCAL")
+        self._region = os.getenv("AWS_REGION")
+        self._ssl_verify = ssl_verify
+        try:
+            if not self._sam_local:
+                self._lambda_client = boto3.client(
+                    "lambda", region_name=self._region, verify=self._ssl_verify
+                )
+                self._events_client = boto3.client(
+                    "events", region_name=self._region, verify=self._ssl_verify
+                )
+                self._logs_client = boto3.client(
+                    "logs", region_name=self._region, verify=self._ssl_verify
+                )
+            if json_logging:
+                log_helper.setup(
+                    log_level, boto_level=boto_level, RequestType="ContainerInit"
+                )
+            else:
+                log_helper.setup(log_level, formatter_cls=None, boto_level=boto_level)
+        except Exception as e:
+            logger.error(e, exc_info=True)
+            self.init_failure(e)
+
+    def __call__(self, event, context):
+        try:
+            self._log_setup(event, context)
+            logger.debug(event)
+            if not self._crhelper_init(event, context):
+                return
+            # Check for polling functions
+            if self._poll_enabled() and self._sam_local:
+                logger.info(
+                    "Skipping poller functionality, as this is a local invocation"
+                )
+            elif self._poll_enabled():
+                self._polling_init(event)
+            # If polling is not enabled, then we should respond
+            else:
+                logger.debug("enabling send_response")
+                self._send_response = True
+            logger.debug("_send_response: %s" % self._send_response)
+            if self._send_response:
+                if self.RequestType == "Delete":
+                    self._wait_for_cwlogs()
+                self._cfn_response(event)
+        except Exception as e:
+            logger.error(e, exc_info=True)
+            self._send(FAILED, str(e))
+        finally:
+            if self._timer:
+                self._timer.cancel()
+
+    def _wait_for_cwlogs(self, sleep=sleep):
+        time_left = int(self._context.get_remaining_time_in_millis() / 1000) - 15
+        sleep_time = 0
+
+        if time_left > self._sleep_on_delete:
+            sleep_time = self._sleep_on_delete
+
+        if sleep_time > 1:
+            sleep(sleep_time)
+
+    def _log_setup(self, event, context):
+        if self._json_logging:
+            log_helper.setup(
+                self._log_level,
+                boto_level=self._boto_level,
+                RequestType=event["RequestType"],
+                StackId=event["StackId"],
+                RequestId=event["RequestId"],
+                LogicalResourceId=event["LogicalResourceId"],
+                aws_request_id=context.aws_request_id,
+            )
+        else:
+            log_helper.setup(
+                self._log_level, boto_level=self._boto_level, formatter_cls=None
+            )
+
+    def _crhelper_init(self, event, context):
+        self._send_response = False
+        self.Status = SUCCESS
+        self.Reason = ""
+        self.PhysicalResourceId = ""
+        self.StackId = event["StackId"]
+        self.RequestId = event["RequestId"]
+        self.LogicalResourceId = event["LogicalResourceId"]
+        self.Data = {}
+        if "CrHelperData" in event.keys():
+            self.Data = event["CrHelperData"]
+        self.RequestType = event["RequestType"]
+        self._event = event
+        self._context = context
+        self._response_url = event["ResponseURL"]
+        if self._timer:
+            self._timer.cancel()
+        if self._init_failed:
+            self._send(FAILED, str(self._init_failed))
+            return False
+        self._set_timeout()
+        self._wrap_function(self._get_func())
+        return True
+
+    def _polling_init(self, event):
+        # Setup polling on initial request
+        logger.debug("pid1: %s" % self.PhysicalResourceId)
+        if "CrHelperPoll" not in event.keys() and self.Status != FAILED:
+            logger.info("Setting up polling")
+            self.Data["PhysicalResourceId"] = self.PhysicalResourceId
+            self._setup_polling()
+            self.PhysicalResourceId = None
+            logger.debug("pid2: %s" % self.PhysicalResourceId)
+        # if physical id is set, or there was a failure then we're done
+        logger.debug("pid3: %s" % self.PhysicalResourceId)
+        if self.PhysicalResourceId or self.Status == FAILED:
+            logger.info("Polling complete, removing cwe schedule")
+            self._remove_polling()
+            self._send_response = True
+
+    def generate_physical_id(self, event):
+        return "_".join(
+            [
+                event["StackId"].split("/")[1],
+                event["LogicalResourceId"],
+                self._rand_string(8),
+            ]
+        )
+
+    def _cfn_response(self, event):
+        # Use existing PhysicalResourceId if it's in the event and no ID was set
+        if not self.PhysicalResourceId and "PhysicalResourceId" in event.keys():
+            logger.info("PhysicalResourceId present in event, Using that for response")
+            self.PhysicalResourceId = event["PhysicalResourceId"]
+        # Generate a physical id if none is provided
+        elif not self.PhysicalResourceId or self.PhysicalResourceId is True:
+            logger.info("No physical resource id returned, generating one...")
+            self.PhysicalResourceId = self.generate_physical_id(event)
+        self._send()
+
+    def _poll_enabled(self):
+        return getattr(self, "_poll_{}_func".format(self._event["RequestType"].lower()))
+
+    def create(self, func):
+        self._create_func = func
+        return func
+
+    def update(self, func):
+        self._update_func = func
+        return func
+
+    def delete(self, func):
+        self._delete_func = func
+        return func
+
+    def poll_create(self, func):
+        self._poll_create_func = func
+        return func
+
+    def poll_update(self, func):
+        self._poll_update_func = func
+        return func
+
+    def poll_delete(self, func):
+        self._poll_delete_func = func
+        return func
+
+    def _wrap_function(self, func):
+        try:
+            self.PhysicalResourceId = func(self._event, self._context) if func else ""
+        except Exception as e:
+            logger.error(str(e), exc_info=True)
+            self.Reason = str(e)
+            self.Status = FAILED
+
+    def _timeout(self):
+        logger.error("Execution is about to time out, sending failure message")
+        self._send(FAILED, "Execution timed out")
+
+    def _set_timeout(self):
+        self._timer = threading.Timer(
+            (self._context.get_remaining_time_in_millis() / 1000.00) - 0.5,
+            self._timeout,
+        )
+        self._timer.start()
+
+    def _get_func(self):
+        request_type = "_{}_func"
+        if "CrHelperPoll" in self._event.keys():
+            request_type = "_poll" + request_type
+        return getattr(self, request_type.format(self._event["RequestType"].lower()))
+
+    def _send(self, status=None, reason="", send_response=_send_response):
+        if len(str(str(self.Reason))) > 256:
+            self.Reason = (
+                "ERROR: (truncated) " + str(self.Reason)[len(str(self.Reason)) - 240 :]
+            )
+        if len(str(reason)) > 256:
+            reason = "ERROR: (truncated) " + str(reason)[len(str(reason)) - 240 :]
+        response_body = {
+            "Status": self.Status,
+            "PhysicalResourceId": str(self.PhysicalResourceId),
+            "StackId": self.StackId,
+            "RequestId": self.RequestId,
+            "LogicalResourceId": self.LogicalResourceId,
+            "Reason": str(self.Reason),
+            "Data": self.Data,
+            "NoEcho": self.NoEcho,
+        }
+        if status:
+            response_body.update({"Status": status, "Reason": reason})
+        send_response(self._response_url, response_body, self._ssl_verify)
+
+    def init_failure(self, error):
+        self._init_failed = error
+        logger.error(str(error), exc_info=True)
+
+    def _cleanup_response(self):
+        for k in ["CrHelperPoll", "CrHelperPermission", "CrHelperRule"]:
+            if k in self.Data.keys():
+                del self.Data[k]
+
+    @staticmethod
+    def _rand_string(l):
+        return "".join(
+            random.choice(string.ascii_uppercase + string.digits) for _ in range(l)
+        )
+
+    def _add_permission(self, rule_arn):
+        sid = self._event["LogicalResourceId"] + self._rand_string(8)
+        self._lambda_client.add_permission(
+            FunctionName=self._context.function_name,
+            StatementId=sid,
+            Action="lambda:InvokeFunction",
+            Principal="events.amazonaws.com",
+            SourceArn=rule_arn,
+        )
+        return sid
+
+    def _put_rule(self):
+        schedule_unit = "minutes" if self._polling_interval != 1 else "minute"
+        response = self._events_client.put_rule(
+            Name=self._event["LogicalResourceId"] + self._rand_string(8),
+            ScheduleExpression="rate({} {})".format(
+                self._polling_interval, schedule_unit
+            ),
+            State="ENABLED",
+        )
+        return response["RuleArn"]
+
+    def _put_targets(self, func_name):
+        region = self._event["CrHelperRule"].split(":")[3]
+        account_id = self._event["CrHelperRule"].split(":")[4]
+        partition = self._event["CrHelperRule"].split(":")[1]
+        rule_name = self._event["CrHelperRule"].split("/")[1]
+        logger.debug(self._event)
+        self._events_client.put_targets(
+            Rule=rule_name,
+            Targets=[
+                {
+                    "Id": "1",
+                    "Arn": "arn:%s:lambda:%s:%s:function:%s"
+                    % (partition, region, account_id, func_name),
+                    "Input": json.dumps(self._event),
+                }
+            ],
+        )
+
+    def _remove_targets(self, rule_arn):
+        self._events_client.remove_targets(Rule=rule_arn.split("/")[1], Ids=["1"])
+
+    def _remove_permission(self, sid):
+        self._lambda_client.remove_permission(
+            FunctionName=self._context.function_name, StatementId=sid
+        )
+
+    def _delete_rule(self, rule_arn):
+        self._events_client.delete_rule(Name=rule_arn.split("/")[1])
+
+    def _setup_polling(self):
+        self._event["CrHelperData"] = self.Data
+        self._event["CrHelperPoll"] = True
+        self._event["CrHelperRule"] = self._put_rule()
+        self._event["CrHelperPermission"] = self._add_permission(
+            self._event["CrHelperRule"]
+        )
+        self._put_targets(self._context.function_name)
+
+    def _remove_polling(self):
+        if "CrHelperData" in self._event.keys():
+            self._event.pop("CrHelperData")
+        if "PhysicalResourceId" in self.Data.keys():
+            self.Data.pop("PhysicalResourceId")
+        if "CrHelperRule" in self._event.keys():
+            self._remove_targets(self._event["CrHelperRule"])
+        else:
+            logger.error(
+                "Cannot remove CloudWatch events rule, Rule arn not available in event"
+            )
+        if "CrHelperPermission" in self._event.keys():
+            self._remove_permission(self._event["CrHelperPermission"])
+        else:
+            logger.error(
+                "Cannot remove lambda events permission, permission id not available in event"
+            )
+        if "CrHelperRule" in self._event.keys():
+            self._delete_rule(self._event["CrHelperRule"])
+        else:
+            logger.error(
+                "Cannot remove CloudWatch events target, Rule arn not available in event"
+            )
diff --git a/infrastructure/custom_resources/crhelper/utils.py b/infrastructure/custom_resources/crhelper/utils.py
new file mode 100644
index 0000000..3f05d49
--- /dev/null
+++ b/infrastructure/custom_resources/crhelper/utils.py
@@ -0,0 +1,61 @@
+from __future__ import print_function
+
+import json
+import logging as logging
+import ssl
+import time
+from http.client import HTTPSConnection
+from os import path
+from typing import AnyStr, Union
+from urllib.parse import urlsplit, urlunsplit
+
+logger = logging.getLogger(__name__)
+
+
+def _send_response(
+    response_url: AnyStr, response_body: AnyStr, ssl_verify: Union[bool, AnyStr] = None
+):
+    try:
+        json_response_body = json.dumps(response_body)
+    except Exception as e:
+        msg = "Failed to convert response to json: {}".format(str(e))
+        logger.error(msg, exc_info=True)
+        response_body = {"Status": "FAILED", "Data": {}, "Reason": msg}
+        json_response_body = json.dumps(response_body)
+    logger.debug("CFN response URL: {}".format(response_url))
+    logger.debug(json_response_body)
+    headers = {"content-type": "", "content-length": str(len(json_response_body))}
+    split_url = urlsplit(response_url)
+    host = split_url.netloc
+    url = urlunsplit(("", "", *split_url[2:]))
+    ctx = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
+    if isinstance(ssl_verify, str):
+        if path.exists(ssl_verify):
+            ctx.load_verify_locations(cafile=ssl_verify)
+        else:
+            logger.warning(
+                "Cert path {0} does not exist!.  Falling back to using system cafile.".format(
+                    ssl_verify
+                )
+            )
+    if ssl_verify is False:
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+    # If ssl_verify is True or None dont modify the context in any way.
+    while True:
+        try:
+            connection = HTTPSConnection(host, context=ctx)
+            connection.request(
+                method="PUT", url=url, body=json_response_body, headers=headers
+            )
+            response = connection.getresponse()
+            logger.info(
+                "CloudFormation returned status code: {}".format(response.reason)
+            )
+            break
+        except Exception as e:
+            logger.error(
+                "Unexpected failure sending response to CloudFormation {}".format(e),
+                exc_info=True,
+            )
+            time.sleep(5)
diff --git a/infrastructure/custom_resources/hosted_ui.py b/infrastructure/custom_resources/hosted_ui.py
new file mode 100644
index 0000000..20a8665
--- /dev/null
+++ b/infrastructure/custom_resources/hosted_ui.py
@@ -0,0 +1,79 @@
+"""Custom resource to update the hosted UI in Cognito.
+
+Mostly taken from: https://python.plainenglish.io/configuring-cognitos-hosted-ui-with-a-custom-resource-in-cdk-python-9f2fde423f95
+"""
+import logging
+import os
+
+import boto3
+from crhelper import CfnResource
+
+logger = logging.getLogger(__name__)
+
+helper = CfnResource(
+    json_logging=False,
+    log_level="DEBUG",
+    boto_level="CRITICAL",
+    sleep_on_delete=120,
+    ssl_verify=None,
+)
+cognito = boto3.client("cognito-idp")
+s3 = boto3.resource("s3")
+
+image = None
+css = None
+
+try:
+    css = s3.Object(os.environ["ASSET_BUCKET"], os.environ["CSS_KEY"]).get()
+    image = s3.Object(os.environ["ASSET_BUCKET"], os.environ["IMAGE_FILE_KEY"]).get()
+except Exception as e:
+    helper.init_failure(e)
+
+
+def set_ui_customizations():
+    try:
+        css_data = css["Body"].read().decode("utf-8")
+        image_data = image["Body"].read()
+        cognito.set_ui_customization(
+            UserPoolId=os.environ["USER_POOL_ID"],
+            ClientId=os.environ["CLIENT_ID"],
+            CSS=css_data,
+            ImageFile=image_data,
+        )
+        logger.info("Updated Cognito Hosted UI")
+    except Exception as e:
+        logger.exception(e)
+        raise ValueError(
+            "An error occurred when attempting to set the UI customizations for the user pool client. See the CloudWatch logs for details"
+        )
+
+
+@helper.create
+def create(event, context):
+    logger.info("Got Create")
+    set_ui_customizations()
+    return None
+
+
+@helper.update
+def update(event, context):
+    logger.info("Got Update")
+    set_ui_customizations()
+    return None
+
+
+@helper.delete
+def delete(event, context):
+    logger.info("Got Delete")
+
+
+@helper.poll_create
+def poll_create(event, context):
+    logger.info("Got create poll")
+    # Return a resource id or True to indicate that creation is complete.
+    # If True is returned an id will be generated
+    return True
+
+
+def handler(event, context):
+    helper(event, context)
diff --git a/infrastructure/hosted_ui.py b/infrastructure/hosted_ui.py
new file mode 100644
index 0000000..fbe0d31
--- /dev/null
+++ b/infrastructure/hosted_ui.py
@@ -0,0 +1,109 @@
+"""Hosted UI for Cognito."""
+import pathlib
+
+import aws_cdk.aws_iam as iam
+import aws_cdk.custom_resources as cr
+from aws_cdk import CustomResource
+from aws_cdk.aws_cognito import UserPool, UserPoolClient
+from aws_cdk.aws_lambda import Architecture, Code, Function, Runtime
+from aws_cdk.aws_logs import RetentionDays
+from aws_cdk.aws_s3_assets import Asset
+from constructs import Construct
+
+CODE_PATH = pathlib.Path(__file__).parent / "custom_resources"
+ASSETS_PATH = pathlib.Path(__file__).parent / "hosted_ui_assets"
+
+
+class HostedUI(Construct):
+    """Hosted UI customisations for Cognito."""
+
+    def __init__(
+        self,
+        scope: Construct,
+        construct_id: str,
+        user_pool: UserPool,
+        client: UserPoolClient,
+    ) -> None:
+        """Create the resources for hosted UI customisations."""
+        super().__init__(scope, construct_id)
+
+        logo = self._create_logo_asset()
+        css = self._create_css_asset()
+        custom_function = self._create_custom_function(css, logo, user_pool, client)
+        provider = self._create_provider(custom_function)
+
+        CustomResource(
+            self,
+            "CustomResource",
+            service_token=provider.service_token,
+            properties={"css": css.s3_object_key, "logo": logo.s3_object_key},
+        )
+
+    def _create_provider(self, custom_function: Function) -> cr.Provider:
+        role = iam.Role(
+            self,
+            "CognitoUiProviderRole",
+            managed_policies=[
+                iam.ManagedPolicy.from_aws_managed_policy_name(
+                    managed_policy_name="AWSLambdaExecute"
+                )
+            ],
+            assumed_by=iam.ServicePrincipal(service="lambda.amazonaws.com"),
+        )
+
+        return cr.Provider(
+            self,
+            "CognitoUiProvider",
+            on_event_handler=custom_function,
+            log_retention=RetentionDays.ONE_WEEK,  # default is INFINITE
+            role=role,
+        )
+
+    def _create_logo_asset(self) -> Asset:
+        return Asset(
+            self,
+            "CognitoHostedUiLogo",
+            path=(ASSETS_PATH / "logo.png").as_posix(),
+        )
+
+    def _create_css_asset(self) -> Asset:
+        return Asset(
+            self,
+            "CognitoHostedUiCss",
+            path=(ASSETS_PATH / "cognito.css").as_posix(),
+        )
+
+    def _create_custom_function(
+        self, css: Asset, logo: Asset, user_pool: UserPool, client: UserPoolClient
+    ) -> Function:
+        custom_function = Function(
+            self,
+            "CognitoSetupUiEventHandler",
+            environment={
+                "ASSET_BUCKET": logo.s3_bucket_name,
+                "IMAGE_FILE_KEY": logo.s3_object_key,
+                "CSS_KEY": css.s3_object_key,
+                "USER_POOL_ID": user_pool.user_pool_id,
+                "CLIENT_ID": client.user_pool_client_id,
+            },
+            runtime=Runtime.PYTHON_3_9,
+            architecture=Architecture.ARM_64,
+            handler="hosted_ui.handler",
+            code=Code.from_asset(CODE_PATH.as_posix()),
+            dead_letter_queue_enabled=True,
+        )
+
+        logo.grant_read(custom_function)
+        css.grant_read(custom_function)
+
+        custom_function.add_to_role_policy(
+            statement=iam.PolicyStatement(
+                actions=[
+                    "cognito-idp:SetUICustomization",
+                ],
+                effect=iam.Effect.ALLOW,
+                resources=[user_pool.user_pool_arn],
+            )
+        )
+
+        return custom_function
diff --git a/infrastructure/hosted_ui_assets/cognito.css b/infrastructure/hosted_ui_assets/cognito.css
new file mode 100644
index 0000000..c845444
--- /dev/null
+++ b/infrastructure/hosted_ui_assets/cognito.css
@@ -0,0 +1,43 @@
+.logo-customizable {
+    max-width: 100%;
+    max-height: 100%;
+}
+
+.banner-customizable {
+    padding: 10px 0px 10px 0px;
+    background-color: #5e6ca9;
+}
+
+.submitButton-customizable {
+    font-size: 14px;
+    font-weight: bold;
+    margin: 20px 0px 10px 0px;
+    height: 40px;
+    width: 100%;
+    color: #fff;
+    background-color: #5e6ca9;
+}
+
+.idpButton-customizable {
+    font-size: 14px;
+    font-weight: bold;
+    margin: 20px 0px 10px 0px;
+    height: 40px;
+    width: 100%;
+    color: #fff;
+    background-color: #5e6ca9;
+}
+
+.submitButton-customizable:hover {
+    color: #fff;
+    background-color: gray;
+}
+
+.idpButton-customizable:hover {
+    color: #fff;
+    background-color: gray;
+}
+
+.inputField-customizable:focus {
+    border-color: #5e6ca9;
+}
diff --git a/infrastructure/hosted_ui_assets/logo.png b/infrastructure/hosted_ui_assets/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..9d33fcbaea136808dd1b244c32851805a4003402
GIT binary patch
literal 14800
zcmc(`byOU|vp+h!EEZe>2_7^MED+oiWN~**u;A{tNJxO-?hx4Ekl@Z@0TLv*v$(rE
zKk~izckg@uzjNN4GpB2MtE;+ud#0*BT^**PB!lyW><It>II>VlH2?rTk{|#B?XfU$
zF0}af<f10?7APO2*m`^jG1rl`P*en19%&2!6+{T2{A2mo3`7Q?{)YwtIS~2(&}yKU
z|IGsifX`L{<iC0J9?O3h^zr_u^uJ1!9MJzt%mM#jZV-@z^1t-IW(j{i<Q@x5N2sm~
z0ALaQyFox&#<NFhx>g!Gt~!bef~F33?C;GSKA5w6+ByDf1qgczK9Y9kuJ36)?QHE`
z1U*G)|HC2pNdK$mpr!c_i>r+Yt&XA!%{vEYa~fWDPIgXO(I+%CG{Vki7J_P$(*NE3
z@kxaCqpPc<AP0wshX=a{H@kzgCC6(40Raw9E)Fg(wnq*&7cYC)_nvI_E_DAT<p0W%
zG<Pv|wsLf}a<HfQC-?ma2RBy{TH1e#{^$Cye!5y&{I4c^m;WBt;{ZAS{lf8@os;8#
zWIr|){#Prg>}+NJsQI6K(bvNN;rxHq{kI-rj(^JkAD#KHk^ZOlaj2qCggO3a+C-l`
zH(Ejm06v(kq=beiXfG49nN7-VUka6&NrM>O2=T&N65lc8<t7nD94zctwrXDCm(EdA
z;y1mH==&|$EJ1W+mKmJ52S;C>B)_R@NJ7T==}0BIo)bv6BW~_nc7*DN8g6#0J{K>v
z_*7iqO_cA?%-0mRo|S2ikI(xcH>G32f#Njy7?A%T3X^LL+t+uD)fK3GbB^y8M?|X>
z=DxAjPA!Lqz1q@2l{ht15x7&V#-w_nl-zpuhj04X&4&$gvz3Q^3l5o`@i}yWB7ph1
z8fX2{N0nd0Y%+`2{_aM46UU-v4hwT=ur~v3KQVLeWH9D?<lGbIWGfTt)jaU)wG0~!
zj&b^!%r1sTYlwF-ab3K;IFmuZMqPW&9rVZ~*o*^%z{(!~GTggSPxumBq}=6$J-&*}
z20Ji@Q?|Df(oWE~_!Tf94eFa)isRh$4vi$JxcG}CB8ITwjy1HCp2Vz2ZSqzg2gC+u
zzY4^kl&6u(zmkBN3<=_i9%`WmZgk)@9!$TOHB@$~`OAQUBwk@@(FpCndPu;g7(}{#
zcUTacrNE`YW{O*B@;%`e)Zyae2A-#&w(TS$wcUk{E8!ur0p&qC*W^~O!RrV&mIXzM
ztJ;Rj%OCdp19Vr>$;?jvv=74PZRrYBZQ70iJ0gteSA_-dPzDydilpWC&}Lg(zbh=H
zFkp20jc#=#0Cof^?Q%p3i#nOJUk+c%1J5<iOUrM<4vmxNIG+2k2W4NAS@A=BnGcNx
zees;u^;|6LM=ehZy&S<D+Z41!OSiAjvK7md>}xns-IHkR-*S0)`%vEQo??p=%wYw1
zB<{5`H<X3U`e*LfU6Wb~L;53Mxn8rUp&D4@Mrs@03~gUyBcfWhz9X)l-x+=%fCeIH
zA&Y1f(^{2UZ@1qV3(g8i?Qb(suL&>vXqo?hc1MIAizAMx0&u-jEI^j2@+gC;(-n=v
zC?=|(yH;B1#nxwMBZkCt#K73$j-Sl-9np*8gUy*xU|-jm?z3Ld?bEgAWE%ffrKVex
z0Ll@mE!}XGhKT$<rQ-q@)ktV$dxAYf-qH4k5+QPV*dkxt<Rzp(HNx$*e0eN!eL}@@
zs8_-;1H`XJ%}%~cA2#dH{q|Q94-pb3BqV2)HDh59pPwEQ<UvshIk#)O>3t)7&{mV*
zTF8Av5<&GQ4AyWW!#r<T1v^MFRpkAaU(P-VAZ&sm8_~1=IRsV)kY_YY_y&4n_6&BS
z72Mo_lm+tKrxbVy>6&!3`z1EROOBBu9{|@yF!k3=f4pAQa;F7)X)5Jw4tscJ1mfly
zejbZWogeKTKC&5TiK-afIJnqfvdnmyX|scx`A=xuzn*a0x#$YTMr#caf*moH_86~_
zMN65Bll?;gaahY?T?_UJTc10j@^oBTxY^eyu`|KqR-fM#_`}(e%2lvG11;y`oZj+{
zhl5qYQ)F(`8%%0^!xbYT<nw7x(y|a={ljxL@T3vV>kGMUHoXf44{?GitN=VhIb%iW
z)r6w#;xn8}fvpmH2-sEHnhJFJM`1T9?v5VLVYM^o{lfyZkrF&YS!4x)_&-G?WWRWE
zSCstprkQ>GHuw7t*)<v+O_ML@^e<i(DX_~fwjMnLx5$@4+Z9ydp&Qe$1--Zj$)0eM
zrUYoz{bb?sjr;}P$Kcvj9LY2)a4D!g*ryni6j~cQr3KeBFBeg4L^`l1sgazqONhgK
zR*}-PVhJ(zJnCFtX1dBQ`GsL_p$sC?^Zpo9B)=yaz*AaQd_ETC?JfF$8P~XlQqDW8
z$IZb_&Z28J^!eYh{c~N9;#8kCOJT<<3e(J~%}#wWW7^wWdw8=k!6@1V`wL+*>#@$2
zxe}q*W@tKYb?@sUjz6vDbSKiHGW=}2BC%AI2>)Gyp6a44j}#%|kmGn8g{v?*h(9&H
z$G29%@J@)ZV173>^P%5tHD$XdL8G$S5}d8b`eUy$o>ueYz8{Sf9avn}9>Z1Wp|uZ)
z>VRV#R6OMN^=gvKopWzf;RTY3QK`{M&WF}4+oqRi&&C*#p^5$CMlM!Cb~}1Y_NwBq
z(!vjKV?RFg_z|XeR7R<Cl};ohEcZ{VK(EkC&A3q1@<!HUOalDE)?YpnT)BZm_QM*v
zq_O@*cTInN*Isw0|BZqx*F`2Eb%XYxwdM{S4+Raqqk)HJ79<c$S~X0SdHb@3^QPd#
zwTnBiedLgZO%?RG#ps^reB2u4fwjx@SDCB{SK;eL-pw1`dwUh6lek~BdaI<Lu&mnk
zk)z9z<w*Af=Iz_Y5)TcF=PMJ{l))p<)+%CS<dk=WKV;03;eUG(fsc=#lo`3z#B#{o
z7Pjh(*_Y?~uOk9if@H<pmLJ%1&gdZGEZ>%6n%Dohksy-%NB*3N88&+ECX0oeNdK*M
zMWr)rlg8u-V%*#R&}ejbUvsT<q&=HH5V9#Y_42_6boe?<W=qX8g?n>}4`ncZKfDP}
zyk6)*0)`o1+|>)-@`n|y3tWp8M%kRLDKpqLWpPhiO`1woV@Xzj+WKCXc<}AO>;0A>
zX3<&gK99>Hlb?(|qkxj1rF1V$T%41AW)DtALao|I^!QSs_75l*i$qu5k7a0Clreq+
zT#0);pZ#<tc7VsCz4`5sKaK*kRKWY|WlZj9PueP|5amANEP=o+yyY01KA~5<g_a6j
z)7R{Et~=_t8=VVU&)|?ac2uNwXb$_!?Hzp?{Z0||B7Z=-#pvkU!LvmERz<&*YPMDi
zQ>Sy4qmVoD&eY<Kt#@m4d6xKBQQ=BT-J*5=AH()=M*OO}mZbJra&6}X^~r&;7aZRx
ziuZivQ(AfEjj$(qLBXnyhevihJ@k7=f-yPu!w8z3gS|thk2i#v$x666GyPcz^74-9
zPPM&t=NUU?-Y2nSHZ`<N>Ut!O?g=BE@yioIQ_nba3!?x~7dK`Qkc^T(0MYnfQLKw_
zaJ${s0Bs~HtZy%kw5TsTzw#?fjEpnqWVgy(ogkzw{!{&&8NU#plgV+DC>aZU9n}Oq
z?qpkl?{PpKRfe#uQ$>c^`F&ntQZP1@wX`Jp*0KY=Dn?y1GS5Wb1v$;u5+Vstq_{(1
zlz${(=yfCmkm@0i^=kr5o*-ZiPM86|FNhe8&QWx1N~m<&;d!}|m3`Js45v&by-yP;
zi7PCPz!(cglyv3!OXN6<3oPq`7c(&-E@i}wMmGFZsLUAkWpLLh4TlmiOwULP`uvc_
z?tr0PyeuNkT0Q^#g-Oqcu`+ZJ31}NRe9S{Q0TGr{*P?AV<iAy^SrU+yD7l<V17NWU
zI+smlFuim{<<f|~Ss+3j(oc#W7(i0+>{AI1qV}@eu3cVZ{kg@KE^M}%#GWat?$?3d
zDE{-V*dwUj0nK{?xZ<9=3+(^^cIOX5yjpdY84HH}-aV`sKCffw2McRXTAV{ZFC7~)
z$iQdxJ9o6+NJ@WLiXMLO2XDqe;!xhsM6%*PBMbD#=P##%6uvl$lxf+Ed8aMB9=Lw|
zVq{=8$Z_7>R4a9(S_=ZWefp><sI@$4Z`ZXQaftzumPFhJ>O%tQM2P;1CWD1-oEvK&
z43|~)(xnLP-jg6~QKI7euND>(L<^_@GmP>+&R$Rl@Lmv21x|$a@e_fZhilYM1$v-q
zG6WRR!%&b}MNjQp^i#}0Im01n17$#L9H5~IdB;QfVa&sfVrmiF_?qnS&G=b~hOum?
z<ws|Y*C4RFtE~YZ_!|;OKRf`ba%H1_xBd&Vjh1Dd^_p&)#R<7b?)jmJqks$;V>U)_
z(U~=PNH)4Obq^ejU?8X0m!);11_`AGBUGJ5>leGl_Av|?k6s!+A*e_1@kl~=#rfsb
zO&)HHfnl^c*%wF&zjComO+v8DqG|rBOk8@h28mnUlgG(hR1^sU@X%iqKIpN1BBFQ6
zuS<Ry#SI8?J&3UYsh@NfF_V<@_LAAT9Ax)ya@koZD;xk16oL0jYqN54%2)ZcY7zLH
zZH~@Ch~edqn%~dAE_|!xkY9w#8vRA9$9<TPgW795RJ0EjK>*PH#@&U6ad!OmPOr|l
zn`d)=eqJcoa;Go0`-5SbI7+3Yq}qK~e$0!Hf8D18c?Op|nk}UKb-{TSEc2U&OmfL2
z>?Dde?2ApO25PF9!NU#YJhf;)PF2+9B(Jd_BgN)0MvT}{{%-kKz)K(M^tia&!bu0}
zAIeZSm!czp=10R`!EUH!VY-hzFhlTDawu$-b>DzN*YK^xm_R(nVhBc5owTn(vNuSk
zJPDCHQU%mMIBxk{9Amojrjg+Q+lAM<^XDs+52k9$uiy5qLht3a?qg>VY(3CG;NKg^
z;$(_Kp?dX-NO)aoW*{r|rkTlcXO*1&PkE{Fr${t_2SF#&c3c%7(j60LN7G28*~THD
z`j*9REGy|U<0)iYV)3QGGMNBvRUkEVQAxHH;pb~2)2A`<T~09jx|$hN2YJ3yH*%RN
z_PF@}8I%G?)>DH#-h`})wF8N<DG2zC2Jx}q;p$FZ&0t1m7v;0uf!_#gPW2$F0=as1
z&d-Z3>bBF_F}pTptTDVN2IhAUl6e!gQyIpOs$tX1RB?FnFF6FTa{PVY+sLXbcgksU
z@DKv4zH{d*UIF)0D`AAn1M1wBmS1lrwVbog7<on}vx+Y>R3Q|QkD`OUUt_6pUnf`V
z(&wUQdj|QgR>W0!TBu0ozGB-awpv{iWoo2Y66Wy`a^8rVD!}M>fj4>Y)6~U1FT(rq
z!bH?A6}1-wyuN|7o;CQ^Y*wkXpnd4V1$X1+ViAmMfo|@xzi(WrB!qdpAGv6@vNLnm
zGo04cD8-|fVz%xo>(7LbkGKcM3%E4RoR6$H@0&9Dn(|?`zGc~BN(6tW>L$z+ot*!D
zK+jMT_idyK7Yqna$X^V>(>HJdccZwl8yUA0QiJk%{$~nAC^L?vvQBE2+h&wi*Y4l9
zZ?sI2i%F|(;dRMO)Ip<CYQsPd33>ha%z{!7UD8;eYvgqsyH{SwDzkw@#Y#49WM9XS
zp;M3f3?{Bgu)f@2;x3I-%!EZg85jciuAax$#BIp$zMJXK4j0IyO|CGd%C~5v;c0O_
z^?<BR8jposwVW#l!V0MMW6iLFV8QCIX5M_DOHp0ofD7ziXEXILunT3W$MtlBVX(@d
zUXy7M&|E_?&B<p=QflIl*({iP>+Yl_O3#QXMM7=s`&9?zJi%2sd(SJUu|9j%I_Ju<
zCkpGS#r?^8z4WR_{ycFixjL24tE*qH<jcm!UG}%|Epb`IN1@3UNR<t}j6AfJWPfj9
zsemH-Gxc{C9-;n55y#$|xK|9e$-8)GE8Nj>93oH2m(^#6vMSL59*w;+l6(8yiE?E&
zcFHSI#HsbxJ;;QagM`PYc-dtT-vno+B#ubEZJ<GobIQ`w{EDQnz#vJ{@*K!XB4~kf
zB+k9-7;6rp($r_5$lUad%`ZykXX!qAt&OpGcsspOLQl@%SiVXVJhUj}k=(5Cw$kD3
zoXgk3O+ktUdER*x!Q(C4Ch}Cj?B!L{o9iaqzTBVW7+)iSj2S(Oo8V*3qNEYws?Iir
z=2puzRI{_`(nL&RWz`9rba{X_<<FyGCP)Nri9rT^P~$2a8aJ{j{}wvZfXAz;%eM--
z85}EE$UP@6jhBTk|MC+0h9`_?SE2#}*$y{*CDN6bGOlK68Z4?}Xf)j?_aYR_RjlAM
z0%S&T@Y(Sk8{%`}1NExu4fExpPK%e=&vI4}O=NRaNb8>V@%5J|eWX6*w>AZgQJS6w
z1EM7^Zm{wI8Ju|k5Qob{s?G1RTd^m9n+?;@mZ15gKqC*R)D?fp|8=xVh<6V_YhS_}
zlNf1fV}JH#yBN)cPGuWIc4K-l!1o5f@?4oE4;g&71LI2Z#uX`m)l;L(6;&h;p<2@B
zSV{3g0o^{DROg?u(E7be((f->Lx76f&W7ybdmP!%0=m$(Amy^8{k{Bj4_n4_WY{Ye
z2g4o~yOR;+tyzCSvFk2$^^8!>>d;4TnHzs91SW8S_SBFjFh1+Ktso1M#6R>A(bCN<
zt~r3u4_Ae;s6ZYqICO0F)z>V;!y)!fM#5x+kmr=+{COuB2!Rvh%(EbqE&rR!>rW#s
zGRtj$evOEz0x{A;R9FFHQX194*4#eFyUVU__om?7#@pU<1{Q2csJJ*qssE<*Rgc@{
z7NIW?l_YmbA{v^-Dpt<z4#b>jKEC%?VI2P35nDr&!_W;pIit%aE%YmD12jr%Bq~^u
z7Qu>e!1gv_&84R9oTPe%yzxQJwifwdAZ3aQFefcoU$@i{`w*DT@nZXARWv9i?K=no
zI6lr4q!<a}|2$ox;)m7zP6M{wN+TvQYWJ$u2-AV)o+p5Hpv-k=wIB7PH-7eOZH{sI
zXRmYEYKVrDIt`OsEGqa9tqFU_0JVIY9)5GO>rycNjhTZ(?@%lXj5g|VNzqf@wxe6I
zuC=ItzCKN`j{G+N)auk@TIFe%M4&h`q)S${vXOqBG-Q%d1b$_eEo9K>Ay);9z4KZn
z8WT|Fi5lh&IO^U!_-C^vwFP~W1h15=3#wKh5w}{J7z!2L?qQBXL&pj3V8Vf}jYE_L
z6@z5rue+b=Pys12v4gfcV$pYR6HFV`SybC*b?)2<?OwuJw{akhk_ZD4+Hn+Z`9a8`
z$aX;E?FVYq>{uj`W3akU@=!i(bN$Quj$`?NJmV?B_yY61u`9q*#JP<N`6cylwphoH
zqBNrYEat4W1&2g?hd#d+V#L4}A$leV6z*HEYObMM`6y#jz7inwaUWiFOKc=&#!tZj
zMPJ%z{&`9mJwl`@xM=2!Z#<{o>g6bC|FMmN1;AHL@Z8?7Rr|rq{9N#N{))^1g@AI*
zKDE4u@PQahkdyBU#+MR*<wZi~3x#O|_HnA4WisD4SH*wOwjWy;qR9}K+quX5xa8bz
z5OiJbst)b#bC}Ie7-Yx!phl!i!}$nwu?(Ri-q-IIU3Vp36amIvOb0ASrhVtrqMsdD
z^oGNps@^s~+_}y~j26AqY?U3D(ic7mup_$@sUd5s<bRF-5e#zDN+`1^RTQnU&K8zz
z^pLFrlG$eWo}$18t5=S8kCF&!2UJF}DEX8gmpF1fY;-);b0L6&cqOBVHiiO!|2PWK
zLr(>luffXh@;FrWO*BL9?VVjwJOk8-SJKvj%m`2Gg@R&MsW&NGgzAN!3u0LLs<K%4
zus{4vb4J6=Odl&ac+QiDM2*@lyDuO~I6$%ZhBj6Jom2uQ*-%ldyLYCmaSpHJmFn?~
zRmb|Ttw6*v2Ex!OrQ628Y1wTH>f(Dv#B}ouWD)FoGHTAcz#(L6%nKCawEFW)K02pF
z?FQcmcKfO#{%D+pYWVO6xToZGgcAJd?6j)iQ*G4Xe(bYbAx~2)NSvT^=;k0Nyt#Pl
zV(M#)<Eo&v>dqvyb0ceBS|JPmM_iDTu12{9s4aHFG;V#Qxwe9edH#WJ0BlfOc;biU
z7E*w1Q!~&KK>ORdXS*bfNHwn4t(NR2Nh6(ZqbpGcH4yQJ00A1#uD^R~*Krni`%8Pc
zq0B5Y#4LM%4?Z-Iq4!V!Ni|Ypi=WJZtATRdmaZn(HGy?HyHE&UCj`h)LiJY$29sC$
zuL~b&wie{u3l4n1?#*MhEGKRrXSP4(zG(R6$=u~*)`n?}Js9yEE1>6KZbzu21Wvp#
zLD#q!;Ms2><TrLE5x<l7o4&a&P9}LY6V$Jge%te_7$4B(21XgQa3A{<=IRhP$W;nz
zD(dEo=R{zn%sSqA5Y``565e%t94)mRZLQ938bGl?;^><<+ex4UQtJ39n(zdLC|E_@
ze#BU)=RzC(jOv930e+94{vj<-eo;VWEgm)9L!;ucQ!<<0)CqLR=R!zMj^p+<<qNVq
z@eX75cnW-PpQGm(u6Q7q+wpC(xgK=h^fb#|-eBR@ugVVRSVrU6;<4>@cl&w4jMtH`
zGsSF=$2LAn!EHu14=Ug9d|3eproI(7ARRAB-RH5c&vrMAx=0}6OuF%(YV~mx(`Y=1
zw*Vy`a2SB|(<WYRB>T5;@|6auM(3%&*&em-M<0J_e#C8@7xb)Wh!NZeTDtvw2*PY#
zOqFO+R~X-Gj_)TdM9=<J#|I@DiCps?U#b0lq4gLCeBq5Cc|sC3SS4}i8jj0z7NeS#
zB*PXcE(#I8bk_eX`g0B%jY8*(<WMQ}><&?OxhFbuL#3XevwurhdU{n9?({T&RJ-5c
zf!VsN!5V@Uz^;F^%1?v82?jfgIz8-c4>1=h2j3zj5P=APp(hmO4_;gO+cViv1kt-_
zxldWnU)7F&^l)txh557VW-FzcS;rTDVa0zLC61ZZIA}WN?F&XaPCHY6_{)e9g8|Ni
zfN#$8R!`;#>K8_1GBt-O3x7H~n@-AK4XHy6iaI}~kIip?;z;&Xf0}DkDVVK^a3~L*
zHLg4bp(}_UVrg!IhD9sma1SL9vsL{zqXf~jjq4}cs%i~&CzQU?Gmyzb1m%x^X{<BL
zK8C?eV0>0fKca~<pG+~<1}2TfGgtm_WdoWk^NBQ{#A)<;Y|qNo_k_E=rPRynzY={_
za>{P_MceQJVV;~)4QIMGrVlKKnv?gX3evy70CfIjy6$Q<w>B<YLV}&uRI?{dgmud3
zc(hxbXFP7$Q^WRXWlRhUT9@nA;`5|tO$S9rV3?n|4v(9#_7iY<mELBBs78mfL;M%P
zPA!#8&W_J?Ggafmbww-2T1G9NZ{AWmZT`kc!8RBXF<<K}a1NQ}f4cULrTgkAnnRX~
zuGPpesG>;8zuHuJO91+|vf}hS^x;i8F3o}mPC}Etk+M+=$X9z-VYoK;hsw9t3LYtT
zoLnMmBj1^e(?*LRfwF_iak&?ERoRODZ(L3b_iv+>28ZTZOjF-|-uZz?k^W?t?%qGc
zmqCAJr=Qn*Se$aU(5~DGYOmtJali!03656j@@YI}X=<;EX-@mb8xQoir})lrVQE?Q
zUoH6`2NqyHL+hd#6vHsRIrkdzd5x}x2ZnPm#5*ffkJz90cNs7N_V7^b+kwj6nY<2h
z6E8@btG{Z%(puA5k?eWonm+$D-}&B!TI6koH-4|`k|E1YYshei`6D7#j|SSzq<>(2
z@tRBO3FLd2xanZFpw-|Cibs47a&luUru4aJq{GTe!S}QZODXlh9KEkAYau*aSTf<&
z=^`#0c=7u_aHvk@$+QsuQ}-u<(wW8?7k@l12*VZIeCxFCfBo@bMIcoKGI@&wh&As)
zJe%Bv6bU=AYGFmVIVX<Yp=xs97Q{_3AY^X$410k$mw+9DNsgg{E#n2XnBrhX>BXg=
z-`E*1$0jEV4Msu+=B3(-tTld}ZgDb^+zb3OG_W6jy^{H1jJ_XS`{vb|)#|66Xw~+3
z`m8i<B<bZ34)rq&4&?OKUE8t(R_k{ZWCEF*GYRYodddna#^|@$`&r?d*OlTX6p&|b
zUcCjf8>HQ&{Qd^k)qW-!qS!7`ewT_Peo9Zo*=KEs+aq-g(!4~c^G-R#e+h)@qJ>Tw
z9(QO2PNM%qqr}}I*O9l_{*FJ*xay4Q8GN9BH!2CeMVb}~EPT_<s4Lt_EP!21pe^H&
zd(YYLEsK{7?0P;_GhAub6k>tmOTdi(5(bm;r#hHd_I-66f*f%#c+Ni8n%62M=x3a^
zaXyc;y|Fej;DXLxlJ>U(lttAnA#+&H^=Q*InauBVaGrgV(bk4H%Cmo=e;PaR0xU0c
zkNm@&=1no5VZ=6v33hDFepute5{)>>V)F7UcI6gZC<TS%cjSXVL6@XZ_(aF!MNZyq
zej2$GuL-OHlFhYAo(?jAsjeE<Ems}-uj0kpx6q*%4|1Ey>vewTQ0cp|P^r;?nV-5q
z4yOQ3gmd=D{^wCAK!;^mM}~<biZ!h`L5<>U5EXnD+ormqyqWf=#|CLo7o5Zidkh?7
z@dDHajoE%&sE_dhtOAE0_Z}oVTt8G{RIX0Rx`%y%1m2A;GL<a-UKR<I1tMKuLB8`I
z=TYJ^v7eMb_!IIQIiL2(9BKNJASqKGJqzn<Qizw$7bGW>SHk||4uq@5YTH1aD*0pU
z+h-nd=`Z&0L%N5Paa9tQup^ak;6xjwpI+gf{2227ozQ=@V05p1v)MOtH%|-`MwwQa
ztpw3fZv8gOy^AD77}Rq4@mYNndA64omkj?cC;ca%wlaxU#lx{4gAbqo3!UyF&YT%i
z!lZbx!ab&cKH2(ah@skwA$#<NDU&1Ub0i@<AM|`_VIgiPFj5tw3KV_kY#a3|8EruG
zl+~Pe$C>$)e?!F_gllWbJD@uJ1|O!3?@<)2Zsg(U32GoX3AEaeW|$lC(Vkh)uwkH(
zxq4InxNUgX{4hTr+Q~rg()15MYi*GBKWSQRV&5sji9!3m3j1B_8O<ULML(cx*MSQL
zgTfN(VoH;RHQ(yyPfG!W6Y%}1h5bn(FiM-2n=E0*yz|dmJ~@B32KJ-V=QE<3m5Gpz
zjiZHMS~u{DtW8p@ObEM=^jqC9v+P^tv#a@IP4ib`Q>)UrwlORv`-v<YmJ#(?wD14s
z4pu}_?FBc=jy=3|TUDsbWyxHm1Lf_8?r9E4_YKf9+<e=PfTLrkR}^u4<>i+@i>j+_
zSnG<n*ifTqHfPc_WN;n()Il!)w<&I4Y&#`eZg+K+l&JxFwH8-0&Ln*nDC^f6hI^T`
zO4es2xPg}t*n=SA4zSAnO<hzxlmNrAVqo=_iM*G+E5CWaeV}Xqh$xluqdew;C_FtD
z@^{c2ZYLC{-1ep9v;M{%_0iyuFnx{0Gzpr^nBdA~A3ku=Xp#r7%s|UxZF$pY{@dv|
zQkGrI9}ZzMo~T`>Y;<%~YoR<;H`Y!rW+kf_zA#pMJ~;G5n9jjeRuJy|Vi93T*gkDn
z@q{a2iu9^%AU89c_v<o(cTg|$Lb7j<KH+@|AtqvTDj0S9Wc(+eO?ss?4vXJO8p6LQ
zn8VVhyxVCv8|ru}|A;t{GAt=`Xi;>VTUy{uJu@1IJ3A+y)wEC=UM&c&YsN7_Kg#gD
zQd=-9<}a=lR+gitJrdU{##s!ZHh!V|>V+z=#&TC~9L3){R1Woxs8LxaISQ}PV$-j|
z3iUiAS1)Row0|eEiK%_frBm991|-XwGM+KXIF?7oMbL}Isr-6-lo)JFH@mcmVHF#!
zp5x*)6`P^urj^%x+&0!goj505sdwxto5$=FuiLu^_f%A~$4$15@H^C5x*%G4U0Ruo
zB3_Jdo<Avzo3KmE{CtT9OZ7o1E{}mDR)avxEB_W_F#$ix=A-ScU7vIq<!v49^SrxC
zSxA@Yn1mtyv9%8cdWE&ldZ(FoYclRqktWHk=k@`R`1AVV`Apti^SHKDe1lg)^_(u)
zL+0$KD%r;k%lVa>t*%NxR99kVr19GiemQ0z)+J~w_mf;XC^OZN+JhQ0Ph%4uIF<@x
zp%cTi>6t_5jKadjS`n}!+vu@K)tmJd>R~*^@jkr1g*SbQBckR8Uy`ZzNYX;?$A(&}
z{Srf5Ga*?qt@VzMDC8sBPHI=>gfkLcNi8k6+2<`Ngd}w6>8Q)t5wYKxfvW9W2f>X8
z*}^=tu|SP6JVcKyl*;hY1D?hMnL^z2Fz8-d;ZRqeY00t_XvfNUOb&^H@h~8ePa~D)
z%P;623K-62Z4X24@8L5?c)zzgd!yRD=onX=ng`!e+X2aHVbiE70UA2K8h)i&LNDRA
zsx8k_z-vPC<%uzA;qI)5U+pw%s<^_B%ZC7}5LHHnXwVKX;~5ruMfB}ixwqME(v!Mx
zcfTV9^0v#tUys}3V@lip^92b#nCCdFIPO!m<Kca&w%eVoEyo<am(;rO-s#Ji3(CIz
zaPI&O@`T7*noXAkhYD|AxyEw}@lRpbb(z<{90ntW2m|>p7IgbU4XBo?r^8RpYJ%Eo
z3IgtW9YkB9ux3?H;syqt6{5g(-#%k#zos3D?EY-nHo0<t)O?*R7#0>v(8@e5F{05E
z9dk_dYs+)MBoiC>JK$&LGm_uPu0iRMU7huI18+IKtx2QNgTT1FH!R{NPf!G(s=Shj
z-d%}0PROIJeod~;pIf%=nQD)m8f%N@MuiIM_}RDPk-QMPJA#pxycv};nXlu4xY-G|
z!GVkoBuGJtYL>Nrv}bm+w2pT80av(|W+vW0L(J|^&lzutTgTn%j>Xh9Wxj7$Zf}lC
z-b|&f-a=@S&jfrOho`uKV$B|SQ-Q&(u?E4#hZj&;e2VwViTjpv2hcjNIg7Q-Oc2IH
zm^w}YV?ixZosTRkKN^K)%!le`jXOP0TkpP~bO*)d;Xc2SMe*6pulZ!kZF-4z^@X>-
zRInYlzu3`noyx&z+<XiVtV6CB^zp|oqF_Yh)5=3}TqFjZyMZGubu)+{`94^c<el#>
z<1AMr=W(0pnfGq2g<Rp%Ek8qY5r?u}%E!O*Zi}Ao_n%94Q;VAQuuos3I^Srm*%aXr
zO?N$wn%5G_IeyS!I7oVS`g4b3S+YDBI&RlK7Rvhg*(T4%1W8j6y0<{z=J1@)WQ47@
zFEu!)WD;pJF1Ku}@?hbSYElpr{wgMZ3E|?ux8J&NM){lnn-To&`<&{>#NVENqj|1-
zF{SCxo+28ap6+T?;XKAB!rF}AFc+*dH>{T&<vKo0fMMwQY~%iyvT3eA3hNndv*3+X
zjDZmhSDyox)V1Zb<e}#c3kxaPx?tFs4nNuN5n@_GI+zR~xjr+x^7wr_csi;?a^jef
zgWGJ>fl3cYym*%`7MPz2_r%O8WYWB+)i%U5%*H^gG(JY|WRTbMldEwl@1l*aZ43i&
z%Bkac8DH~YC~NiYulsi?k3`SATr=XNv@3bqv`a05DCz}I`L{G!S7eez=x*tg3RCDV
zyBOnD!4TZ_)4Z|fPhZ_v<S)l$i^f1N_M)=QZ9F4i-Xc1OSNN>*x$VBblT<4|NI|W)
z%@1E*48)l7!T=y(j8yX{f+{u(980KoQ`!^)G)Hdq<%qJbpEt!>v~?utu2&zo&K)Ss
zIz{z?oFz;O`zl|_ChBCBfZC7$0bYd&QuH-@zH?Ls#&4(JD4d@%EGVP?nkAxP*wcIB
z;$m8pp*vs9jw+qndgEJ<wz0VIawB?%gY(yC(J<wrfpHh~JT0!x%Tf>xGZ&4*pDjRj
z0s((lY0*07*$m7e%?65Ju%Lj3z&hB?a$F@<0RI)x$IXzRYXMr;a+@!^b#NU-$_eun
zL=j?U=h{^#|G|m#E2&Ff;`RZcs)<D-sMgsB)T3c>eV}!n=e-W$=IAA6=rcwhPfDlU
z@@B60#}-E1*+3CqPWkm*V*$#W{BBK+&Geg;$z<k(i680Q$Y%MV7gyHr&gLZS&8Jbs
zt#f3szRTSf=E-c$?Roe~%6&Jz74H*+cjVIg2=Z1g;d5?b?oP^CIFSGwOTR@JI1*yC
zmc!dV>pOludCaeR#E7u`<(=LY&x<B%>c#>&U*IrJ#Z>>I395KK+hemm@iH#*kY4{}
z;-3+x72jRTc|S4RfWAtWLbH<u4`Qv8esFRa72nUjaO&m`mb&|UG495fF+wT>=kUA#
zX3D)kr9Dw(*Op+<E@qIVsyIDM`t<eKAzw+iapGbQLthXmtiLY4G%@CytmZ<~H!2Jk
zc1f0b5c~UauXy^>il5V<A<qmRki+$PVq2%a+lv7O5DlvE)ofk)ToHby_%jOsXM!+`
z4*`lFL*EBKboq-c>&_`W-@?q;YZ@AbR8&rutcr>UWx@R3)9UE!45{@e0kQ#jXO>lb
z@=FfOf8W6`7xU*f)@<cl*l)~uW}$X3*SWQ{9K>t)AXGG2MRKWJgo+VTRSaj;6_1;D
zaaEJY=l<RrtGOI%Rt1|@eK)ey&j#vZ9ecu8{m;&MoqDhW96h#Pi}K1S`4m39x$1w8
zD=xrdR37#1aW%P}>cRc8m^oS;A<tiriGmNQQS&RM{fU%VHt67pLDoh2?bky-F>+|<
zS)sStxCTRnGE_0wnu+bHU6}z1Gcw=ruP$%dwg$c)MIz<3m{89%39pL<BhZ1s&CgKw
z1ZjWKuNrBrQ6oF%z4}EsM_J-{7a7^VrmA4e2EV5-HAwwn5vy2AOoLyzo?6-$9lH_6
z-OSGZd9cd%gu6a)qUJ1DO@9BnK6q5YCYFG|CFdUH|2lI<wnLdGR!;gLD^%c`SXS4#
zU3E~UPK@a%_W;?G!=Tut2f``syTD|9xDq0>Np?|9)>wi`G|*v@j{Zi$q2jM)pAy>}
z-JB=0)^cu<Pqg72a>@?7ho9vxTE;^MNW4hMo{_K6n%sMmsCXw()MdWP+-U!ZgC73s
zc5%0*#!E+V*g&pnn){}MWosSzHDdl;f5w^I(aP)m?w=EX31hJw1IFT1ak&T^9N2X^
z!V;(he><6tMi*~aF&q}<E1q2BXy-Ltata{T;|NLa7jY?Ao=+jL?kpF{N1~&1s$$1<
z0BFlkQF|=Hv(5TEV?lbGb@@mp%&8s>9p#!zmek4LAq6IeIworkFkK~g=LOa~A-7e`
zB5ub*jY>R~wgbs28M!S34Trqnk}2D*&Bql*PrIp|p(1WD0i#g!wd+PHjIP0a49~8I
z7?$hMkeq$yvwSx`uU5aM7i!+tYPS0c)}Mb0Ni_@0-2TU5DK&1{cWpb6OME_drgn(+
zFR|#FhF-mRo`Hh}Zf3Oe)Tw)RJMAe~8}E_{`49_hom%Hsuq7(P_0sf9(I4#0A1Ug7
zp};U!W`nwoT?=&w?u7NsTGUxQboYKtQ4oQm%?>87kjeeqtcZDzz1z(r*08p-d)+7B
z*j<FeH%6VoMC&-)OJ0N)Aof?oR@Z&3i@0&)vJ!opSsMK^TIr~_5+eSl+ioj)y3*D1
zE-2-lUQ`9Y(4h=h$kD$WE-WA#g3ujG+AJi|OB}&G!Y$PB+9sAZHLk?_(J#1+M3;u!
zvkY;%*{BI`VjBjH=e!JUSwJq<xG{o*-{uNJ-e5r=0d)}GCL?p3fr0m4u7;SNZpCh4
zy<QnAzRn{$F@2d(o4CkoPt2`ae^2oKT=sn^UP^LAw5^GQHONF3sb!VDMW>|8MaadX
z`mjQeE=OaN?~9Sr>!6+}mYh&)*_y<sPBe!?RPXP~&4O-|Y7MBYo&+skjP=K>sVjbK
zXUo3T-)~xA)LdbnUac8)!l}^(Ud=kls=P5D(iLCO$)GQ7O}9``&ty={yaY?=XpG9(
zw>VOJF=6H;U@J*37hM?IrMwY=PWiDZ(iO<jdvw{Uwg&%hWq8r+j_Tmyk};Rjs`I#0
z(Pa1-wW{luyT}PntJo<F4pj}cjbfIJ%Hn@F>$sBNc{zPQF~KIpRbm==p~iDeS(Hn4
zr8m2eMrP4^)GRiLoI1G=zUDmxOoH-1UQ+D^D0S3$TaCEBN25v6OI2{sI$uTo;bn{k
z`{Q_h;(ULBaI<?vB{WJOk#+#`B*aPoR-u}7S8HF2VweSDraT1pFAQzr<0*d{k_}dI
zBxjHBx6`_(r1wE8Y>g`MF`T83J;6uf-BrrzN-+++vhr@p-cu&Z=m~zHPo30-3Ea9n
z-O6tr_nNEMIog25-*)8d=G_?&y|((U^i`Hz<#Ev@Z(mPp7~6aivw8>>rWPf-^rs6P
zrFUtr<69fjLWN0^k;t$Uu{TF6rtyuOde28H$In+h8JcB9%!w#v+{@}++H}v8jh1MF
zXn20-v?$%oNe8`Qm;Wrui-nO78$4sL2*}QwnPWkJ`GqdyQ<LMAgKTY7PZ<_K8v!<V
ziwL<mZ}~|0>Ktq;9dGC1Y%P{?(r+T&^hTp<{vfYwYiFb;VCQ;I8h1R85s%R1D@7?I
zx3jR(+tX8PYa+$>`PP~3)|BWG6CxNIHpq_ewlCGS0y8f}sn{B{M)KK~yyAm1Nkznp
z{ZA^!pC*roPQZ0BfQzTr&Abh8$Y)!-^zqv7qwl1CRLv@I0;)H~#*M1?I(z=#tYXL}
zETg!B=ii-QCEXw$g+kSOc;sHi!%lp_ND>$;ZHvP4PBG(*!r#X(>?9--xH1}9#Icpw
z7_T+oom18L@L}R%B;u}*4Jkym2OEc2)28NCC=L#N<K+&5=F!qrYCu$5%T@_7!!}Um
z7$*ZZ3-=;dW<SB8AMTs!34YbGbyH6U6cNvnyqODie^FJ$1E)J=R5Z26M6d+01k@IL
zHicm5A72lv^Dih)Ne$n8*pfEh(W)4)<*iV~s2ora#%*`w!@aV!?&f2tOET$<vjMHI
zw~yTMZbc0n!;}-YLx#^u8R+j<^UOYsC%LjjYWu6p?gXz%ihFFD*?t;`+gpI!#o5jL
zGeAmN<}cy2{HC0YeW+$U%de0^(~)POd^6`eA12zw3^xU^az+yb6x-qJ<w^U+PB)yx
zO%%;IX^QTT{Xn6j%qd4BiuF55*WlriW_voj0ExH9n{$tHx2C(B0;R@#Ok&fi!8MKU
z>aBUJb%bhLz4psL?o|w*tnO=%C6j`jI@BL5HL;lwZr5oJE)Sp%3CRYQy;xJM<67MN
zf8w1ey+$8_<dQ})t$|s_m0zqm@ch_FmRXZmn7nk;q5p#1b(6E5iQ?9px(R*j+NE>`
zN4v$cnt>D0V;1mjF)`4A=u9sirt3zHzON`uQT1OMn!AZQwadIDK#`O!nf!ViVrEAE
zV$WhoxO;^o&qGN%irGk(E?TwDc16DH#+qC|*0$*%2<LJT7DoD-|LgmvSmjtsyWMD}
zbZ@dGWLFEB;loznUjjh7R&ScfI^(hp$EjoI9kp`Cm)N$_FurkilpEfmyBfQ9Z=UX5
zD5FIuE+{glZYS|C7Cjg<ZCvzbxK~-OlX(}*d`%ppr?%j=26=jqL`*6evmTM_z<W0f
znmyZmqSIPaeaI?^#np>RaZP<F4h=8^ZY=bzs-Rqxo(m7%>mLXdRjmRb5bvkW2@XsR
z3U65`AG5~}NAAnQN334Z%u;K;&T076mMw>LKh?hK$Ia(%`k31r(c(36o&0;U5BHYZ
zaBFyKw7C-=-`0BF5>h$h4X0J3hByjK-=xdqDkEp5|0P`OSIEz$Z*AOJ@;blQ63Dgv
z>+?c-*0N-?J#J)F41;sDzUa<S5pHK{pGmjSUL!@3A*EuO)$8nAfqJX_e6eauQmxT=
zb8+BNdOqz4K86Y2et$wWx*&9ON*lCTwQi&-m`BY3vcV=Ke|vS4e_BMyG4f_2RAtNy
z(qA;XdaKN{VbL;ahzZ=^A$)piNTK#GtUfSu?wm)T<9&uTxYppdwSf_zo&aTcnQcpr
zV?xD5c-6f$bIInf*WbF8c$;YpOxiqd`cph+<TEjDe6}$F5BhF*VFRyT0=<mmnSplI
zKCP=m49|*)B$V#HyrG2j=Tghv*)LCxug|!q#cSJGX3z<U#ir`Jln^Nx)%Qi{jqxgD
zq`bQ=;~T{5G2lJnceOw>k>?kD^-%r$Jf73<m7l}ZHr)XUczy7>^YvYS8N1uh2oRzU
zmHOqo%=oWsQW@;i?AK}}fr6G)rGR4;SiHNe(mK7Yg*zDtRSaErGQsYC7|x9Q-STCn
zlNJx6^%jxgrLLVx4G8j~<fuOZTG{Gb+^=Leg`mwTdH>F9Jm#Jz8gCXFJ_XqM3ed86
zf{oqn(O@`coJf+}RQE}yCRd9k#xtf$XAFD*N*;IOv0iIjp`R`)B!H6R6FyaG=%yb-
z)3XK~*!if+q(4qpD@F?4oSc6Se;0#!H@sD5$n!muB``%VAZ7!SJfVxv6eK@Xd!S9H
z0J*I8uHHHpR#o*3q5+;U*uCBerka}<n0ITb`_Mpfv41B?u72>Jgt^WibR+zGhI~`=
z=KDR&8gM<2q_0}s`n?DjC@YZ5y8B}<vpFFBVPeIz!Uqo`E(L!$UA@s@OJ-0G41eV&
zCI(Y?!Qui@X<jn$dRIyOiHG}A1+M&tCE%(RYrtDZ0&#%PJ3!szF14b0=>`PA>mA)4
zfwTU%f0VmZ%U4FOo&#tKgUXT{9BtZ6c^^*y<t(OPJ<91!9Av*8R}>}X20W%z4X@gY
zb{*&^Wou6_Vuu(W5BT(~p5CO>odk6?qr$F<f{c@54;WvA*1Ok-hZHfU&dD`TRZwBs
z%z*3iXHi}^r^5*Y1MoBO<AEWG{hi|w8iyy9oW0nvEvh=0@Y6Ai{3u#j<WC;no^xdK
zZh8iCD6;UQ=!n4pU^_w#@$A^)W$`In6%R;0#(>BJTfO@upaYGw9ee??0KVvx8zpg>
z#wKUJbuIvqpI@9=P?s8t-KAUdK&5jd4a6F+8IoUM`TX!?zSJe~&P&dP9N?_PHjc!g
zeao|K^Dx2ETCy4yr!TioMt#=yDs1aslkmQOjj8e?(bcx-jydAZXADj-jmy+o!>;p`
zPyDoL$ZQBI9oSRH8rfwbgKxr!AQJtTKJ)+efwdF?$h{aVr;CE$vyPB|#~Nj&lqAdF
HngsnHMu!<l

literal 0
HcmV?d00001

diff --git a/infrastructure/user_pool.py b/infrastructure/user_pool.py
index 0da06c5..c568f3a 100644
--- a/infrastructure/user_pool.py
+++ b/infrastructure/user_pool.py
@@ -4,6 +4,7 @@
 from aws_cdk.aws_lambda import Function
 from constructs import Construct
 
+from infrastructure.hosted_ui import HostedUI
 from infrastructure.settings import Settings
 
 
@@ -38,6 +39,10 @@ def __init__(
             ),
         )
         domain = f"https://{settings.cognito_domain_prefix}.auth.{self._user_pool.stack.region}.amazoncognito.com"
+        HostedUI(
+            self, "HostedUICustomisations", self._user_pool, self._user_pool_client
+        )
+
         CfnOutput(self, "CognitoDomainOutput", value=domain)
 
     @property
diff --git a/pyproject.toml b/pyproject.toml
index e8a1f58..ccad695 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -27,6 +27,7 @@ select = ["A", "B", "D", "E", "F", "N"]
 ignore = [
     "D203",
     "D213",
+    "E501",
 ]
 
 exclude = [
@@ -34,7 +35,8 @@ exclude = [
     ".venv",
     "cdk.out",
     ".git",
-    ".ruff_cache"
+    ".ruff_cache",
+    "infrastructure/custom_resources/*"
 ]
 
 [tool.mypy]