feat: replace role mapping lambda in auth category (#13003)

* chore: test s3 access * chore: test migration scenarios * chore: add some headless test * chore: group lambda removal * chore: tests * chore: tests * chore: codeql * chore: pr feedback
aws-amplify · Jul 26, 2023 · 4ce0329 · 4ce0329
1 parent fbfa9a0
commit 4ce0329
Show file tree

Hide file tree

Showing 20 changed files with 1,810 additions and 1,092 deletions.
diff --git a/packages/amplify-category-auth/resources/auth-custom-resource/role-map-lambda-function.js b/packages/amplify-category-auth/resources/auth-custom-resource/role-map-lambda-function.js
diff --git a/...tils/awscloudformation/auth-stack-builder/__snapshots__/auth-stack-transform.test.ts.snap b/...tils/awscloudformation/auth-stack-builder/__snapshots__/auth-stack-transform.test.ts.snap
@@ -1348,11 +1348,55 @@ exports.handler = (event, context, callback) => {
     "IdentityPoolRoleMap": {
       "DependsOn": [
         "IdentityPool",
+        "UserPoolClient",
+        "UserPoolClientWeb",
       ],
       "Properties": {
         "IdentityPoolId": {
           "Ref": "IdentityPool",
         },
+        "RoleMappings": {
+          "UserPoolClientRoleMapping": {
+            "AmbiguousRoleResolution": "AuthenticatedRole",
+            "IdentityProvider": {
+              "Fn::Sub": [
+                "cognito-idp.\${region}.amazonaws.com/\${userPool}:\${client}",
+                {
+                  "client": {
+                    "Ref": "UserPoolClient",
+                  },
+                  "region": {
+                    "Ref": "AWS::Region",
+                  },
+                  "userPool": {
+                    "Ref": "UserPool",
+                  },
+                },
+              ],
+            },
+            "Type": "Token",
+          },
+          "UserPoolWebClientRoleMapping": {
+            "AmbiguousRoleResolution": "AuthenticatedRole",
+            "IdentityProvider": {
+              "Fn::Sub": [
+                "cognito-idp.\${region}.amazonaws.com/\${userPool}:\${webClient}",
+                {
+                  "region": {
+                    "Ref": "AWS::Region",
+                  },
+                  "userPool": {
+                    "Ref": "UserPool",
+                  },
+                  "webClient": {
+                    "Ref": "UserPoolClientWeb",
+                  },
+                },
+              ],
+            },
+            "Type": "Token",
+          },
+        },
         "Roles": {
           "authenticated": {
             "Ref": "authRoleArn",