Jay Brown
6dccf494f8
cleanup permit policies and correct documentation * docs * policy cleanup * refactor * Merge remote-tracking branch 'origin/feature/permit-policy-cleanup' into feature/permit-policy-cleanup * docs and edits
100 lines
4.0 KiB
Bash
Executable File
100 lines
4.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# this is the second version of this script with a few bug fixes around the
|
|
# domain creation and the ui customization. This version works and is tested.
|
|
AWS_REGION="us-east-2"
|
|
AWS_PROFILE="aarete"
|
|
# domain prefix should be unique
|
|
DOMAIN_PREFIX="aarete-mfa-test2"
|
|
LOG_FILE="creation.log.txt"
|
|
# pool stuff
|
|
# this is the unique name of the new pool to create. (and all of its dependencies)
|
|
NEW_USER_POOL_NAME="Aarete-MFA-Test-Pool-2"
|
|
# user stuff
|
|
TEST_USER_EMAIL="foo@gmail.com"
|
|
TEST_USER_PHONE="+18889091485"
|
|
TEMP_PASSWORD="TempPass123!"
|
|
|
|
> "$LOG_FILE"
|
|
|
|
echo "Creating Cognito User Pool..." | tee -a "$LOG_FILE"
|
|
USER_POOL_ID=$(aws cognito-idp create-user-pool \
|
|
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
|
|
--pool-name "$NEW_USER_POOL_NAME" \
|
|
--username-attributes "email" \
|
|
--auto-verified-attributes "email" \
|
|
--policies "PasswordPolicy={MinimumLength=8,RequireUppercase=true,RequireLowercase=true,RequireNumbers=true,RequireSymbols=true}" \
|
|
--query "UserPool.Id" --output text)
|
|
|
|
if [ $? -ne 0 ] || [ -z "$USER_POOL_ID" ]; then
|
|
echo "Error: Failed to create Cognito User Pool." >&2
|
|
exit 1
|
|
fi
|
|
echo "User Pool created with ID $USER_POOL_ID" | tee -a "$LOG_FILE"
|
|
|
|
echo "Enabling TOTP MFA (software token) for the user pool..." | tee -a "$LOG_FILE"
|
|
aws cognito-idp set-user-pool-mfa-config \
|
|
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
|
|
--user-pool-id "$USER_POOL_ID" \
|
|
--mfa-configuration "ON" \
|
|
--software-token-mfa-configuration Enabled=true
|
|
|
|
echo "Creating user pool domain '$DOMAIN_PREFIX'..." | tee -a "$LOG_FILE"
|
|
aws cognito-idp create-user-pool-domain \
|
|
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
|
|
--domain "$DOMAIN_PREFIX" \
|
|
--user-pool-id "$USER_POOL_ID"
|
|
|
|
echo "Waiting for domain to activate (60 seconds)..." | tee -a "$LOG_FILE"
|
|
sleep 60
|
|
|
|
echo "Applying required minimal branding at pool level..." | tee -a "$LOG_FILE"
|
|
aws cognito-idp set-ui-customization \
|
|
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
|
|
--user-pool-id "$USER_POOL_ID" \
|
|
--css ".banner-customizable {background-color:#000000;} .label-customizable {color:#FFFFFF;}"
|
|
|
|
echo "Creating app client for user pool..." | tee -a "$LOG_FILE"
|
|
APP_CLIENT_OUTPUT=$(aws cognito-idp create-user-pool-client \
|
|
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
|
|
--user-pool-id "$USER_POOL_ID" \
|
|
--client-name "AareteMfaTestClient" \
|
|
--generate-secret \
|
|
--refresh-token-validity 30 \
|
|
--allowed-o-auth-flows "code" \
|
|
--allowed-o-auth-scopes "openid" "email" "profile" \
|
|
--allowed-o-auth-flows-user-pool-client \
|
|
--callback-urls "http://localhost:8080/login-callback" \
|
|
--logout-urls "http://localhost:8080/logout" \
|
|
--supported-identity-providers "COGNITO")
|
|
|
|
CLIENT_ID=$(echo "$APP_CLIENT_OUTPUT" | jq -r '.UserPoolClient.ClientId')
|
|
CLIENT_SECRET=$(echo "$APP_CLIENT_OUTPUT" | jq -r '.UserPoolClient.ClientSecret')
|
|
|
|
echo "App Client ID: $CLIENT_ID" | tee -a "$LOG_FILE"
|
|
echo "App Client Secret: $CLIENT_SECRET" | tee -a "$LOG_FILE"
|
|
|
|
|
|
|
|
echo "Creating test user '$TEST_USER_EMAIL'..." | tee -a "$LOG_FILE"
|
|
aws cognito-idp admin-create-user \
|
|
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
|
|
--user-pool-id "$USER_POOL_ID" \
|
|
--username "$TEST_USER_EMAIL" \
|
|
--user-attributes Name=email,Value="$TEST_USER_EMAIL" Name=phone_number,Value="$TEST_USER_PHONE" \
|
|
--temporary-password "$TEMP_PASSWORD" \
|
|
--message-action "SUPPRESS"
|
|
|
|
aws cognito-idp admin-set-user-password \
|
|
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
|
|
--user-pool-id "$USER_POOL_ID" \
|
|
--username "$TEST_USER_EMAIL" \
|
|
--password "$TEMP_PASSWORD" \
|
|
--permanent
|
|
|
|
echo "==== Creation Summary ====" | tee -a "$LOG_FILE"
|
|
echo "User Pool ID: $USER_POOL_ID" | tee -a "$LOG_FILE"
|
|
echo "Domain URL: https://$DOMAIN_PREFIX.auth.$AWS_REGION.amazoncognito.com" | tee -a "$LOG_FILE"
|
|
echo "App Client ID: $CLIENT_ID" | tee -a "$LOG_FILE"
|
|
echo "App Client Secret: $CLIENT_SECRET" | tee -a "$LOG_FILE"
|
|
echo "Test User: $TEST_USER_EMAIL" | tee -a "$LOG_FILE"
|