{
  "Description": "{\"createdOn\":\"Mac\",\"createdBy\":\"Amplify\",\"createdWith\":\"10.0.0\",\"stackType\":\"auth-Cognito\",\"metadata\":{}}",
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "env": {
      "Type": "String"
    },
    "identityPoolName": {
      "Type": "String"
    },
    "allowUnauthenticatedIdentities": {
      "Type": "String"
    },
    "resourceNameTruncated": {
      "Type": "String"
    },
    "userPoolName": {
      "Type": "String"
    },
    "autoVerifiedAttributes": {
      "Type": "CommaDelimitedList"
    },
    "mfaConfiguration": {
      "Type": "String"
    },
    "mfaTypes": {
      "Type": "CommaDelimitedList"
    },
    "smsAuthenticationMessage": {
      "Type": "String"
    },
    "smsVerificationMessage": {
      "Type": "String"
    },
    "emailVerificationSubject": {
      "Type": "String"
    },
    "emailVerificationMessage": {
      "Type": "String"
    },
    "defaultPasswordPolicy": {
      "Type": "String"
    },
    "passwordPolicyMinLength": {
      "Type": "String"
    },
    "passwordPolicyCharacters": {
      "Type": "CommaDelimitedList"
    },
    "requiredAttributes": {
      "Type": "CommaDelimitedList"
    },
    "aliasAttributes": {
      "Type": "CommaDelimitedList"
    },
    "userpoolClientGenerateSecret": {
      "Type": "String"
    },
    "userpoolClientRefreshTokenValidity": {
      "Type": "String"
    },
    "userpoolClientWriteAttributes": {
      "Type": "CommaDelimitedList"
    },
    "userpoolClientReadAttributes": {
      "Type": "CommaDelimitedList"
    },
    "userpoolClientLambdaRole": {
      "Type": "String"
    },
    "userpoolClientSetAttributes": {
      "Type": "String"
    },
    "authSelections": {
      "Type": "String"
    },
    "resourceName": {
      "Type": "String"
    },
    "sharedId": {
      "Type": "String"
    },
    "serviceName": {
      "Type": "String"
    },
    "useDefault": {
      "Type": "String"
    },
    "authRoleArn": {
      "Type": "String"
    },
    "unauthRoleArn": {
      "Type": "String"
    },
    "breakCircularDependency": {
      "Type": "String"
    },
    "useEnabledMfas": {
      "Type": "String"
    },
    "dependsOn": {
      "Type": "CommaDelimitedList"
    }
  },
  "Conditions": {
    "ShouldNotCreateEnvResources": {
      "Fn::Equals": [
        {
          "Ref": "env"
        },
        "NONE"
      ]
    },
    "ShouldOutputAppClientSecrets": {
      "Fn::Equals": [
        {
          "Ref": "userpoolClientGenerateSecret"
        },
        true
      ]
    }
  },
  "Resources": {
    "UserPool": {
      "Type": "AWS::Cognito::UserPool",
      "Properties": {
        "AutoVerifiedAttributes": [
          "email"
        ],
        "EmailVerificationMessage": {
          "Ref": "emailVerificationMessage"
        },
        "EmailVerificationSubject": {
          "Ref": "emailVerificationSubject"
        },
        "MfaConfiguration": {
          "Ref": "mfaConfiguration"
        },
        "Policies": {
          "PasswordPolicy": {
            "MinimumLength": {
              "Ref": "passwordPolicyMinLength"
            },
            "RequireLowercase": false,
            "RequireNumbers": false,
            "RequireSymbols": false,
            "RequireUppercase": false
          }
        },
        "Schema": [
          {
            "Mutable": true,
            "Name": "email",
            "Required": true
          }
        ],
        "UserPoolName": {
          "Fn::If": [
            "ShouldNotCreateEnvResources",
            {
              "Ref": "userPoolName"
            },
            {
              "Fn::Join": [
                "",
                [
                  {
                    "Ref": "userPoolName"
                  },
                  "-",
                  {
                    "Ref": "env"
                  }
                ]
              ]
            }
          ]
        }
      }
    },
    "UserPoolClientWeb": {
      "Type": "AWS::Cognito::UserPoolClient",
      "Properties": {
        "UserPoolId": {
          "Ref": "UserPool"
        },
        "ClientName": "flexsd149a0f5f_app_clientWeb",
        "RefreshTokenValidity": {
          "Ref": "userpoolClientRefreshTokenValidity"
        },
        "TokenValidityUnits": {
          "RefreshToken": "days"
        }
      },
      "DependsOn": [
        "UserPool"
      ]
    },
    "UserPoolClient": {
      "Type": "AWS::Cognito::UserPoolClient",
      "Properties": {
        "UserPoolId": {
          "Ref": "UserPool"
        },
        "ClientName": "flexsd149a0f5f_app_client",
        "GenerateSecret": {
          "Ref": "userpoolClientGenerateSecret"
        },
        "RefreshTokenValidity": {
          "Ref": "userpoolClientRefreshTokenValidity"
        },
        "TokenValidityUnits": {
          "RefreshToken": "days"
        }
      },
      "DependsOn": [
        "UserPool"
      ]
    },
    "UserPoolClientRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        },
        "RoleName": {
          "Fn::If": [
            "ShouldNotCreateEnvResources",
            {
              "Ref": "userpoolClientLambdaRole"
            },
            {
              "Fn::Join": [
                "",
                [
                  "upClientLambdaRole149a0f5f",
                  {
                    "Fn::Select": [
                      3,
                      {
                        "Fn::Split": [
                          "-",
                          {
                            "Ref": "AWS::StackName"
                          }
                        ]
                      }
                    ]
                  },
                  "-",
                  {
                    "Ref": "env"
                  }
                ]
              ]
            }
          ]
        }
      },
      "DependsOn": [
        "UserPoolClient"
      ]
    },
    "UserPoolClientLambda": {
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Code": {
          "ZipFile": "const response = require('cfn-response');\nconst aws = require('aws-sdk');\nconst identity = new aws.CognitoIdentityServiceProvider();\nexports.handler = (event, context, callback) => {\n  if (event.RequestType == 'Delete') {\n    response.send(event, context, response.SUCCESS, {});\n  }\n  if (event.RequestType == 'Update' || event.RequestType == 'Create') {\n    const params = {\n      ClientId: event.ResourceProperties.clientId,\n      UserPoolId: event.ResourceProperties.userpoolId,\n    };\n    identity\n      .describeUserPoolClient(params)\n      .promise()\n      .then(res => {\n        response.send(event, context, response.SUCCESS, { appSecret: res.UserPoolClient.ClientSecret });\n      })\n      .catch(err => {\n        response.send(event, context, response.FAILED, { err });\n      });\n  }\n};\n"
        },
        "Role": {
          "Fn::GetAtt": [
            "UserPoolClientRole",
            "Arn"
          ]
        },
        "Handler": "index.handler",
        "Runtime": "nodejs14.x",
        "Timeout": 300
      },
      "DependsOn": [
        "UserPoolClientRole"
      ]
    },
    "UserPoolClientLambdaPolicy": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "cognito-idp:DescribeUserPoolClient"
              ],
              "Resource": {
                "Fn::GetAtt": [
                  "UserPool",
                  "Arn"
                ]
              }
            }
          ]
        },
        "PolicyName": "flexsd149a0f5f_userpoolclient_lambda_iam_policy",
        "Roles": [
          {
            "Ref": "UserPoolClientRole"
          }
        ]
      },
      "DependsOn": [
        "UserPoolClientLambda"
      ]
    },
    "UserPoolClientLogPolicy": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Resource": {
                "Fn::Sub": [
                  "arn:aws:logs:${region}:${account}:log-group:/aws/lambda/${lambda}:log-stream:*",
                  {
                    "region": {
                      "Ref": "AWS::Region"
                    },
                    "account": {
                      "Ref": "AWS::AccountId"
                    },
                    "lambda": {
                      "Ref": "UserPoolClientLambda"
                    }
                  }
                ]
              }
            }
          ]
        },
        "PolicyName": "flexsd149a0f5f_userpoolclient_lambda_log_policy",
        "Roles": [
          {
            "Ref": "UserPoolClientRole"
          }
        ]
      },
      "DependsOn": [
        "UserPoolClientLambdaPolicy"
      ]
    },
    "UserPoolClientInputs": {
      "Type": "Custom::LambdaCallout",
      "Properties": {
        "ServiceToken": {
          "Fn::GetAtt": [
            "UserPoolClientLambda",
            "Arn"
          ]
        },
        "clientId": {
          "Ref": "UserPoolClient"
        },
        "userpoolId": {
          "Ref": "UserPool"
        }
      },
      "DependsOn": [
        "UserPoolClientLogPolicy"
      ],
      "UpdateReplacePolicy": "Delete",
      "DeletionPolicy": "Delete"
    },
    "IdentityPool": {
      "Type": "AWS::Cognito::IdentityPool",
      "Properties": {
        "AllowUnauthenticatedIdentities": {
          "Ref": "allowUnauthenticatedIdentities"
        },
        "CognitoIdentityProviders": [
          {
            "ClientId": {
              "Ref": "UserPoolClient"
            },
            "ProviderName": {
              "Fn::Sub": [
                "cognito-idp.${region}.amazonaws.com/${client}",
                {
                  "region": {
                    "Ref": "AWS::Region"
                  },
                  "client": {
                    "Ref": "UserPool"
                  }
                }
              ]
            }
          },
          {
            "ClientId": {
              "Ref": "UserPoolClientWeb"
            },
            "ProviderName": {
              "Fn::Sub": [
                "cognito-idp.${region}.amazonaws.com/${client}",
                {
                  "region": {
                    "Ref": "AWS::Region"
                  },
                  "client": {
                    "Ref": "UserPool"
                  }
                }
              ]
            }
          }
        ],
        "IdentityPoolName": {
          "Fn::If": [
            "ShouldNotCreateEnvResources",
            "flexsdkjsaws_identitypool_149a0f5f",
            {
              "Fn::Join": [
                "",
                [
                  "flexsdkjsaws_identitypool_149a0f5f__",
                  {
                    "Ref": "env"
                  }
                ]
              ]
            }
          ]
        }
      },
      "DependsOn": [
        "UserPoolClientInputs"
      ]
    },
    "IdentityPoolRoleMap": {
      "Type": "AWS::Cognito::IdentityPoolRoleAttachment",
      "Properties": {
        "IdentityPoolId": {
          "Ref": "IdentityPool"
        },
        "Roles": {
          "unauthenticated": {
            "Ref": "unauthRoleArn"
          },
          "authenticated": {
            "Ref": "authRoleArn"
          }
        }
      },
      "DependsOn": [
        "IdentityPool"
      ]
    }
  },
  "Outputs": {
    "IdentityPoolId": {
      "Description": "Id for the identity pool",
      "Value": {
        "Ref": "IdentityPool"
      }
    },
    "IdentityPoolName": {
      "Value": {
        "Fn::GetAtt": [
          "IdentityPool",
          "Name"
        ]
      }
    },
    "UserPoolId": {
      "Description": "Id for the user pool",
      "Value": {
        "Ref": "UserPool"
      }
    },
    "UserPoolArn": {
      "Description": "Arn for the user pool",
      "Value": {
        "Fn::GetAtt": [
          "UserPool",
          "Arn"
        ]
      }
    },
    "UserPoolName": {
      "Value": {
        "Ref": "userPoolName"
      }
    },
    "AppClientIDWeb": {
      "Description": "The user pool app client id for web",
      "Value": {
        "Ref": "UserPoolClientWeb"
      }
    },
    "AppClientID": {
      "Description": "The user pool app client id",
      "Value": {
        "Ref": "UserPoolClient"
      }
    },
    "AppClientSecret": {
      "Value": {
        "Fn::GetAtt": [
          "UserPoolClientInputs",
          "appSecret"
        ]
      },
      "Condition": "ShouldOutputAppClientSecrets"
    }
  }
}