我正在尝试创建一个堆栈，该堆栈将使用其应用程序客户端和身份池创建用户池。这是堆栈:
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters" : {
"CognitoUserPoolName": {
"Description": "Name of the Cognito user pool as a parameter passed into this template.",
"Type": "String"
}
},
"Resources": {
"UserPool": {
"Type": "AWS::Cognito::UserPool",
"Properties": {
"UserPoolName" : {
"Ref": "CognitoUserPoolName"
},
"Policies": {
"PasswordPolicy": {
"MinimumLength": 8,
"RequireUppercase": true,
"RequireLowercase": true,
"RequireNumbers": true,
"RequireSymbols": true
}
},
"Schema": [
{
"Name": "name",
"AttributeDataType": "String",
"Mutable": true,
"Required": false
},
{
"Name": "email",
"AttributeDataType": "String",
"Mutable": false,
"Required": true
},
{
"Name": "phone_number",
"AttributeDataType": "String",
"Mutable": false,
"Required": false
}
],
"LambdaConfig": {},
"AutoVerifiedAttributes": [
"email"
],
"UsernameAttributes": [
"email"
],
"SmsVerificationMessage": "Your verification code is {####}. ",
"EmailVerificationMessage": "Your app verification code is {####}. ",
"EmailVerificationSubject": "Your app verification code",
"SmsAuthenticationMessage": "Your authentication code is {####}. ",
"MfaConfiguration": "OFF",
"EmailConfiguration": {},
"UserPoolTags": {},
"AdminCreateUserConfig": {
"AllowAdminCreateUserOnly": false,
"UnusedAccountValidityDays": 7,
"InviteMessageTemplate": {
"SMSMessage": "Your username is {username} and temporary password is {####}. ",
"EmailMessage": "Your username is {username} and temporary password is {####}. ",
"EmailSubject": "Your temporary password"
}
}
}
},
"UserPoolClient": {
"Type": "AWS::Cognito::UserPoolClient",
"Description": "App Client.",
"DependsOn": "UserPool",
"Properties": {
"ClientName": {
"Fn::Sub": "${CognitoUserPoolName}Client"
},
"ExplicitAuthFlows": [
"ADMIN_NO_SRP_AUTH"
],
"GenerateSecret": false,
"RefreshTokenValidity": 30,
"UserPoolId": {
"Ref": "UserPool"
}
}
},
"IdentityPool": {
"Type" : "AWS::Cognito::IdentityPool",
"DependsOn": ["UserPool", "UserPoolClient"],
"Properties" : {
"AllowUnauthenticatedIdentities" : false,
"CognitoIdentityProviders" : [
{
"ClientId": {
"Ref": "UserPool"
},
"ProviderName": {
"Fn::GetAtt": [
"UserPool",
"Arn"
]
}
}
],
"IdentityPoolName" : {
"Fn::Sub": "${CognitoUserPoolName}IdentityPool"
}
}
}
},
"Outputs": {
"UserPoolARN": {
"Value": {
"Fn::GetAtt": [
"UserPool",
"Arn"
]
}
}
}
}
我不断收到此错误:
dentityPool CREATE_FAILED 1 validation error detected: Value 'us-east-1_<>' at 'cognitoIdentityProviders.1.member.clientId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\w_]+ (Service: AmazonCognitoIdentity; Status Code: 400; Error Code: ValidationException; Request ID: <>)
用户池 ID 的格式似乎不正确。
我尝试像这样编辑 CognitoIdentityProviders:
"CognitoIdentityProviders" : [
{
"ClientId": {
"Ref": "UserPool"
}
},
{
"ClientId": {
"Ref": "UserPoolClient"
}
}
],
但我不断收到同样的错误。我之前使用控制台创建过身份池，您应该添加用户池 ID 和应用程序客户端 ID，以及用户池 ID 的格式为 us-east-1-1_string。
Update 18 Jun
按照下面 jens 的回答，我能够创建身份池。但是，用户池 ID 和应用客户端 id 都具有用户池 ID 的值:us-east-1 -1_string。
我尝试添加另一个提供商，如下所示:
"ClientId": {
"Ref": "UserPoolClient"
},
"ProviderName": {
"Fn::GetAtt": [
"UserPool",
"ProviderName"
]
}
它确实创建了正确的提供者:
用户池 ID:us-east-1-1_string。例如:us-east-1_Ab129faBb应用客户端 ID:字符串。例如:7lhlkkfbfb4q5kpp90urffao但是提供者有重复。 我已经尝试过
将
应用程序客户端 ID、提供程序名称更改为UserPoolClient，但创建失败。删除
应用客户端 ID的ProviderName，但创建失败。
最佳答案
这似乎是 CloudFormation 实现中的一个错误。
如果将 ClientID 从 us-east-1-1_string 更改为 us_east_1_1_string，则会构建模板，并且 UI 会显示正确的原始字符串(带有破折号)。
由于 CloudFormation 也没有替换功能，因此替换字符串的唯一方法是拆分并重新连接字符串部分。
因此，对于 3 个破折号，您需要以下构造:
"ClientId": {
"Fn::Join": ["_",
[{"Fn::Select": ["0",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
{"Fn::Select": ["1",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
{"Fn::Select": ["2",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
{"Fn::Select": ["3",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]}
]
]
}
我尝试执行你的模板，它总是为我生成一个带有 2 个破折号的字符串。因此，对于两个破折号版本，这将是完整的模板:
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"CognitoUserPoolName": {
"Description": "Name of the Cognito user pool as a parameter passed into this template.",
"Type": "String"
}
},
"Resources": {
"UserPool": {
"Type": "AWS::Cognito::UserPool",
"Properties": {
"UserPoolName": {
"Ref": "CognitoUserPoolName"
},
"Policies": {
"PasswordPolicy": {
"MinimumLength": 8,
"RequireUppercase": true,
"RequireLowercase": true,
"RequireNumbers": true,
"RequireSymbols": true
}
},
"Schema": [{
"Name": "name",
"AttributeDataType": "String",
"Mutable": true,
"Required": false
},
{
"Name": "email",
"AttributeDataType": "String",
"Mutable": false,
"Required": true
},
{
"Name": "phone_number",
"AttributeDataType": "String",
"Mutable": false,
"Required": false
}
],
"LambdaConfig": {},
"AutoVerifiedAttributes": [
"email"
],
"UsernameAttributes": [
"email"
],
"SmsVerificationMessage": "Your verification code is {####}. ",
"EmailVerificationMessage": "Your app verification code is {####}. ",
"EmailVerificationSubject": "Your app verification code",
"SmsAuthenticationMessage": "Your authentication code is {####}. ",
"MfaConfiguration": "OFF",
"EmailConfiguration": {},
"UserPoolTags": {},
"AdminCreateUserConfig": {
"AllowAdminCreateUserOnly": false,
"UnusedAccountValidityDays": 7,
"InviteMessageTemplate": {
"SMSMessage": "Your username is {username} and temporary password is {####}. ",
"EmailMessage": "Your username is {username} and temporary password is {####}. ",
"EmailSubject": "Your temporary password"
}
}
}
},
"UserPoolClient": {
"Type": "AWS::Cognito::UserPoolClient",
"Description": "App Client.",
"DependsOn": "UserPool",
"Properties": {
"ClientName": {
"Fn::Sub": "${CognitoUserPoolName}Client"
},
"ExplicitAuthFlows": [
"ADMIN_NO_SRP_AUTH"
],
"GenerateSecret": false,
"RefreshTokenValidity": 30,
"UserPoolId": {
"Ref": "UserPool"
}
}
},
"IdentityPool": {
"Type": "AWS::Cognito::IdentityPool",
"DependsOn": ["UserPool", "UserPoolClient"],
"Properties": {
"AllowUnauthenticatedIdentities": false,
"CognitoIdentityProviders": [{
"ClientId": {
"Fn::Join": [
"_",
[
{
"Fn::Select": [
"0",
{
"Fn::Split": [
"-",
{
"Ref": "UserPool"
}
]
}
]
},
{
"Fn::Select": [
"1",
{
"Fn::Split": [
"-",
{
"Ref": "UserPool"
}
]
}
]
},
{
"Fn::Select": [
"2",
{
"Fn::Split": [
"-",
{
"Ref": "UserPool"
}
]
}
]
}
]
]
},
"ProviderName": {
"Fn::GetAtt": [
"UserPool",
"ProviderName"
]
}
}],
"IdentityPoolName": {
"Fn::Sub": "${CognitoUserPoolName}IdentityPool"
}
}
}
},
"Outputs": {
"UserPoolARN": {
"Value": {
"Fn::GetAtt": [
"UserPool",
"Arn"
]
}
}
}
}
关于amazon-web-services - 无法创建 AWS Cognito 身份池，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/56634904/