UserPool

Source: src/AWS/Cognito/UserPool.ts

An Amazon Cognito user pool — a managed user directory that handles sign-up, sign-in, and token issuance (OIDC-compliant JWTs) for your application.

Creating a User Pool

Basic User Pool

import * as Cognito from "alchemy/AWS/Cognito";

const pool = yield* Cognito.UserPool("Users", {});

Email Sign-In with Password Policy

const pool = yield* Cognito.UserPool("Users", {
  usernameAttributes: ["email"],
  autoVerifiedAttributes: ["email"],
  passwordPolicy: {
    minimumLength: 12,
    requireSymbols: false,
  },
});

Admin-Only User Creation

const pool = yield* Cognito.UserPool("Users", {
  adminCreateUserOnly: true,
  accountRecovery: [{ name: "admin_only", priority: 1 }],
});

Custom Attributes

const pool = yield* Cognito.UserPool("Users", {
  schema: [
    { name: "tenantId", mutable: false },
    { name: "plan", attributeDataType: "String" },
  ],
});

Sending Email Through SES

const identity = yield* SES.EmailIdentity("Sender", {
  emailIdentity: "mail.example.com",
});
// allow Cognito to send through the identity
yield* SES.EmailIdentityPolicy("CognitoSend", {
  emailIdentity: identity.emailIdentity,
  policyName: "cognito",
  policy: {
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Principal: { Service: "cognito-idp.amazonaws.com" },
      Action: ["ses:SendEmail", "ses:SendRawEmail"],
      Resource: identity.identityArn,
    }],
  },
});
const pool = yield* Cognito.UserPool("Users", {
  usernameAttributes: ["email"],
  autoVerifiedAttributes: ["email"],
  emailConfiguration: {
    emailSendingAccount: "DEVELOPER",
    sourceArn: identity.identityArn,
    from: "My App <no-reply@mail.example.com>",
    replyToEmailAddress: "support@example.com",
  },
});

Email OTP with a Custom Email Sender

const key = yield* KMS.Key("CodeKey", {});
const sender = yield* Lambda.Function("EmailSender", {
  main: import.meta.url,
});
yield* Lambda.Permission("CognitoInvoke", {
  functionName: sender.functionName,
  action: "lambda:InvokeFunction",
  principal: "cognito-idp.amazonaws.com",
});
const pool = yield* Cognito.UserPool("Auth", {
  tier: "ESSENTIALS",
  usernameAttributes: ["email"],
  signInPolicy: { allowedFirstAuthFactors: ["PASSWORD", "EMAIL_OTP"] },
  customEmailSender: { lambdaArn: sender.functionArn },
  kmsKeyId: key.keyArn,
});

App Clients and Auth

const pool = yield* Cognito.UserPool("Users", {});
const client = yield* Cognito.UserPoolClient("Web", {
  userPoolId: pool.userPoolId,
  explicitAuthFlows: ["ALLOW_USER_PASSWORD_AUTH", "ALLOW_REFRESH_TOKEN_AUTH"],
});