使用 CDK 添加 AWS Cognito 用户池角色
Adding AWS Cognito User Pool role using CDK
我已经部署了https://github.com/aws-samples/amazon-elasticsearch-service-with-cognito to my stack, and am trying to add a master
group as per https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html#fgac-walkthrough-iam
diff --git a/lib/search-stack.ts b/lib/search-stack.ts
index 85de0c0..2493c92 100644
--- a/lib/search-stack.ts
+++ b/lib/search-stack.ts
@@ -3,7 +3,7 @@
import { Fn, Stack, Construct, StackProps, CfnParameter, CfnOutput } from '@aws-cdk/core';
import { CfnDomain } from '@aws-cdk/aws-elasticsearch';
-import { UserPoolAttribute, CfnUserPoolDomain, CfnIdentityPool, CfnIdentityPoolRoleAttachment, CfnUserPool } from '@aws-cdk/aws-cognito';
+import { UserPoolAttribute, CfnUserPoolDomain, CfnIdentityPool, CfnIdentityPoolRoleAttachment, CfnUserPool, CfnUserPoolGroup } from '@aws-cdk/aws-cognito';
import { Role, ManagedPolicy, ServicePrincipal, FederatedPrincipal } from '@aws-cdk/aws-iam';
import { CustomResource } from '@aws-cdk/aws-cloudformation';
@@ -55,6 +55,19 @@ export class SearchStack extends Stack {
}, "sts:AssumeRoleWithWebIdentity")
});
+ // create two groups, one for admins one for users
+
+ new CfnUserPoolGroup(this, "AdminsGroup", {
+ groupName: "master-user-group",
+ userPoolId: idPool.ref,
+
+ });
+
+ new CfnUserPoolGroup(this, "UsersGroup", {
+ groupName: "limited-user-group",
+ userPoolId: idPool.ref,
+ });
+
const esRole = new Role(this, "esRole", {
assumedBy: new ServicePrincipal('es.amazonaws.com'),
managedPolicies: [ManagedPolicy.fromAwsManagedPolicyName("AmazonESCognitoAccess")]
~
但是在重新部署之后,角色没有被创建!
非常感谢任何建议。
好的,我需要使用:
new CfnUserPoolGroup(this, "AdminsGroup", {
groupName: "master-user-group",
userPoolId: userPool.ref
});
new CfnUserPoolGroup(this, "UsersGroup", {
groupName: "limited-user-group",
userPoolId: userPool.ref
});
而不是idPool.ref
从版本 1.1.1 开始,amazon-elasticsearch-service-with-cognito code 包括细粒度访问控制的配置,包括名为“es-admins”的 Amazon Cognito 组,以及所需的角色解析。
从 AWS CDK v1.91.0 开始,使用 userPoolId
而不是 ref
:
import * as cognito from '@aws-cdk/aws-cognito';
//...
const userPool = new cognito.UserPool(this, 'UserPool', {
//...
});
new cognito.CfnUserPoolGroup(this, "ManagerGroup", {
groupName: "manager",
userPoolId: userPool.userPoolId
});
我已经部署了https://github.com/aws-samples/amazon-elasticsearch-service-with-cognito to my stack, and am trying to add a master
group as per https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/fgac.html#fgac-walkthrough-iam
diff --git a/lib/search-stack.ts b/lib/search-stack.ts
index 85de0c0..2493c92 100644
--- a/lib/search-stack.ts
+++ b/lib/search-stack.ts
@@ -3,7 +3,7 @@
import { Fn, Stack, Construct, StackProps, CfnParameter, CfnOutput } from '@aws-cdk/core';
import { CfnDomain } from '@aws-cdk/aws-elasticsearch';
-import { UserPoolAttribute, CfnUserPoolDomain, CfnIdentityPool, CfnIdentityPoolRoleAttachment, CfnUserPool } from '@aws-cdk/aws-cognito';
+import { UserPoolAttribute, CfnUserPoolDomain, CfnIdentityPool, CfnIdentityPoolRoleAttachment, CfnUserPool, CfnUserPoolGroup } from '@aws-cdk/aws-cognito';
import { Role, ManagedPolicy, ServicePrincipal, FederatedPrincipal } from '@aws-cdk/aws-iam';
import { CustomResource } from '@aws-cdk/aws-cloudformation';
@@ -55,6 +55,19 @@ export class SearchStack extends Stack {
}, "sts:AssumeRoleWithWebIdentity")
});
+ // create two groups, one for admins one for users
+
+ new CfnUserPoolGroup(this, "AdminsGroup", {
+ groupName: "master-user-group",
+ userPoolId: idPool.ref,
+
+ });
+
+ new CfnUserPoolGroup(this, "UsersGroup", {
+ groupName: "limited-user-group",
+ userPoolId: idPool.ref,
+ });
+
const esRole = new Role(this, "esRole", {
assumedBy: new ServicePrincipal('es.amazonaws.com'),
managedPolicies: [ManagedPolicy.fromAwsManagedPolicyName("AmazonESCognitoAccess")]
~
但是在重新部署之后,角色没有被创建!
非常感谢任何建议。
好的,我需要使用:
new CfnUserPoolGroup(this, "AdminsGroup", {
groupName: "master-user-group",
userPoolId: userPool.ref
});
new CfnUserPoolGroup(this, "UsersGroup", {
groupName: "limited-user-group",
userPoolId: userPool.ref
});
而不是idPool.ref
从版本 1.1.1 开始,amazon-elasticsearch-service-with-cognito code 包括细粒度访问控制的配置,包括名为“es-admins”的 Amazon Cognito 组,以及所需的角色解析。
从 AWS CDK v1.91.0 开始,使用 userPoolId
而不是 ref
:
import * as cognito from '@aws-cdk/aws-cognito';
//...
const userPool = new cognito.UserPool(this, 'UserPool', {
//...
});
new cognito.CfnUserPoolGroup(this, "ManagerGroup", {
groupName: "manager",
userPoolId: userPool.userPoolId
});