Very much inspired by Rosberg Linhares example, but in python, and using the AWS cfn helper module:
If you write a lambda function with this code, basically using boto3 to do the client app settings
from crhelper import CfnResource
import boto3
from copy import copy
# setup the cfn helper
helper = CfnResource()
client = boto3.client('cognito-idp')
# these wrappers return the function unaltered, so we can chain them to apply
# the function in both create and update
@helper.create
@helper.update
def update_on_create(event, _):
params = copy(event['ResourceProperties'])
del params['ServiceToken']
client.update_user_pool_client(**params)
# don't do anything on delete. Deleting the client app is handled by the template
@helper.delete
def delete_user_pool_client(event, _):
pass
def handler(event, context):
helper(event, context)
Then your cloudformation would be similar, e.g.
UserPoolClient:
Type: AWS::Cognito::UserPoolClient
Properties:
ClientName: 'TestClient'
GenerateSecret: true
UserPoolId: !Ref UserPool
UserPoolClientSettings:
Type: Custom::CognitoUserPoolClientSettings
DependsOn:
- LambdaForAppClientSettings
- UserPoolClient
Properties:
ServiceToken: !GetAtt LambdaForAppClientSettings.Arn
UserPoolId: !Ref UserPool
ClientId: !Ref UserPoolClient
CallbackURLs:
- https://www.amazon.com
SupportedIdentityProviders:
- COGNITO
With the possible benefit that you can specify either some or all of the arguments to update_user_pool_client(), due to the parameter expansion in client.update_user_pool_client(**params). You do have to make sure that the keys in the Properties map of your cloudformation custom resource match exactly what is required by boto3. Check the boto3 documentation for the list of possible args.
