我正在尝试创建一个堆栈，该堆栈将使用其App Client和Identity Pool创建一个用户池。这是堆栈：
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters" : {
"CognitoUserPoolName": {
"Description": "Name of the Cognito user pool as a parameter passed into this template.",
"Type": "String"
}
},
"Resources": {
"UserPool": {
"Type": "AWS::Cognito::UserPool",
"Properties": {
"UserPoolName" : {
"Ref": "CognitoUserPoolName"
},
"Policies": {
"PasswordPolicy": {
"MinimumLength": 8,
"RequireUppercase": true,
"RequireLowercase": true,
"RequireNumbers": true,
"RequireSymbols": true
}
},
"Schema": [
{
"Name": "name",
"AttributeDataType": "String",
"Mutable": true,
"Required": false
},
{
"Name": "email",
"AttributeDataType": "String",
"Mutable": false,
"Required": true
},
{
"Name": "phone_number",
"AttributeDataType": "String",
"Mutable": false,
"Required": false
}
],
"LambdaConfig": {},
"AutoVerifiedAttributes": [
"email"
],
"UsernameAttributes": [
"email"
],
"SmsVerificationMessage": "Your verification code is {####}. ",
"EmailVerificationMessage": "Your app verification code is {####}. ",
"EmailVerificationSubject": "Your app verification code",
"SmsAuthenticationMessage": "Your authentication code is {####}. ",
"MfaConfiguration": "OFF",
"EmailConfiguration": {},
"UserPoolTags": {},
"AdminCreateUserConfig": {
"AllowAdminCreateUserOnly": false,
"UnusedAccountValidityDays": 7,
"InviteMessageTemplate": {
"SMSMessage": "Your username is {username} and temporary password is {####}. ",
"EmailMessage": "Your username is {username} and temporary password is {####}. ",
"EmailSubject": "Your temporary password"
}
}
}
},
"UserPoolClient": {
"Type": "AWS::Cognito::UserPoolClient",
"Description": "App Client.",
"DependsOn": "UserPool",
"Properties": {
"ClientName": {
"Fn::Sub": "${CognitoUserPoolName}Client"
},
"ExplicitAuthFlows": [
"ADMIN_NO_SRP_AUTH"
],
"GenerateSecret": false,
"RefreshTokenValidity": 30,
"UserPoolId": {
"Ref": "UserPool"
}
}
},
"IdentityPool": {
"Type" : "AWS::Cognito::IdentityPool",
"DependsOn": ["UserPool", "UserPoolClient"],
"Properties" : {
"AllowUnauthenticatedIdentities" : false,
"CognitoIdentityProviders" : [
{
"ClientId": {
"Ref": "UserPool"
},
"ProviderName": {
"Fn::GetAtt": [
"UserPool",
"Arn"
]
}
}
],
"IdentityPoolName" : {
"Fn::Sub": "${CognitoUserPoolName}IdentityPool"
}
}
}
},
"Outputs": {
"UserPoolARN": {
"Value": {
"Fn::GetAtt": [
"UserPool",
"Arn"
]
}
}
}
}
我不断收到此错误：
dentityPool CREATE_FAILED 1 validation error detected: Value 'us-east-1_<>' at 'cognitoIdentityProviders.1.member.clientId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\w_]+ (Service: AmazonCognitoIdentity; Status Code: 400; Error Code: ValidationException; Request ID: <>)
User Pool ID的格式似乎不正确。
我试图像这样编辑CognitoIdentityProviders：
"CognitoIdentityProviders" : [
{
"ClientId": {
"Ref": "UserPool"
}
},
{
"ClientId": {
"Ref": "UserPoolClient"
}
}
],
但是我一直收到相同的错误。之前，我已经使用控制台创建了身份池，应该同时添加User Pool ID和App Client ID，并且User Pool ID的格式为us-east-1-1_string。
更新6月18日
按照下面的詹斯回答，我能够创建身份池。但是，User Pool ID和App client id都具有User Pool ID的值：us-east-1-1_string。
我试图添加另一个像这样的提供者：
"ClientId": {
"Ref": "UserPoolClient"
},
"ProviderName": {
"Fn::GetAtt": [
"UserPool",
"ProviderName"
]
}
它确实创建了正确的提供者：
User Pool ID：us-east-1-1_string。例如：us-east-1_Ab129faBb App client id：string。例如：7lhlkkfbfb4q5kpp90urffao
，但是提供者重复。 我尝试过
将提供者名称App client id更改为UserPoolClient，但创建失败。
ProviderName中的App client id，但创建失败。答案 0 :(得分：1)
这似乎是CloudFormation实现中的错误。
如果将ClientID从us-east-1-1_string更改为us_east_1_1_string，则会构建模板，并且UI会显示正确的原始字符串（带短划线）。
由于CloudFormation也没有替换功能，所以替换字符串的唯一方法是拆分并重新连接字符串部分。
因此，对于3个破折号，您将需要以下构造：
"ClientId": {
"Fn::Join": ["_",
[{"Fn::Select": ["0",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
{"Fn::Select": ["1",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
{"Fn::Select": ["2",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]},
{"Fn::Select": ["3",{"Fn::Split": ["-",{ "Ref": "UserPool"}]}]}
]
]
}
我尝试执行您的模板，它总是为我生成一个带有2个破折号的字符串。因此对于两个破折号版本，这将是完整的模板：
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"CognitoUserPoolName": {
"Description": "Name of the Cognito user pool as a parameter passed into this template.",
"Type": "String"
}
},
"Resources": {
"UserPool": {
"Type": "AWS::Cognito::UserPool",
"Properties": {
"UserPoolName": {
"Ref": "CognitoUserPoolName"
},
"Policies": {
"PasswordPolicy": {
"MinimumLength": 8,
"RequireUppercase": true,
"RequireLowercase": true,
"RequireNumbers": true,
"RequireSymbols": true
}
},
"Schema": [{
"Name": "name",
"AttributeDataType": "String",
"Mutable": true,
"Required": false
},
{
"Name": "email",
"AttributeDataType": "String",
"Mutable": false,
"Required": true
},
{
"Name": "phone_number",
"AttributeDataType": "String",
"Mutable": false,
"Required": false
}
],
"LambdaConfig": {},
"AutoVerifiedAttributes": [
"email"
],
"UsernameAttributes": [
"email"
],
"SmsVerificationMessage": "Your verification code is {####}. ",
"EmailVerificationMessage": "Your app verification code is {####}. ",
"EmailVerificationSubject": "Your app verification code",
"SmsAuthenticationMessage": "Your authentication code is {####}. ",
"MfaConfiguration": "OFF",
"EmailConfiguration": {},
"UserPoolTags": {},
"AdminCreateUserConfig": {
"AllowAdminCreateUserOnly": false,
"UnusedAccountValidityDays": 7,
"InviteMessageTemplate": {
"SMSMessage": "Your username is {username} and temporary password is {####}. ",
"EmailMessage": "Your username is {username} and temporary password is {####}. ",
"EmailSubject": "Your temporary password"
}
}
}
},
"UserPoolClient": {
"Type": "AWS::Cognito::UserPoolClient",
"Description": "App Client.",
"DependsOn": "UserPool",
"Properties": {
"ClientName": {
"Fn::Sub": "${CognitoUserPoolName}Client"
},
"ExplicitAuthFlows": [
"ADMIN_NO_SRP_AUTH"
],
"GenerateSecret": false,
"RefreshTokenValidity": 30,
"UserPoolId": {
"Ref": "UserPool"
}
}
},
"IdentityPool": {
"Type": "AWS::Cognito::IdentityPool",
"DependsOn": ["UserPool", "UserPoolClient"],
"Properties": {
"AllowUnauthenticatedIdentities": false,
"CognitoIdentityProviders": [{
"ClientId": {
"Fn::Join": [
"_",
[
{
"Fn::Select": [
"0",
{
"Fn::Split": [
"-",
{
"Ref": "UserPool"
}
]
}
]
},
{
"Fn::Select": [
"1",
{
"Fn::Split": [
"-",
{
"Ref": "UserPool"
}
]
}
]
},
{
"Fn::Select": [
"2",
{
"Fn::Split": [
"-",
{
"Ref": "UserPool"
}
]
}
]
}
]
]
},
"ProviderName": {
"Fn::GetAtt": [
"UserPool",
"ProviderName"
]
}
}],
"IdentityPoolName": {
"Fn::Sub": "${CognitoUserPoolName}IdentityPool"
}
}
}
},
"Outputs": {
"UserPoolARN": {
"Value": {
"Fn::GetAtt": [
"UserPool",
"Arn"
]
}
}
}
}
答案 1 :(得分：0)
非常感谢@jens的上述回答。确实有效，尽管我的更新中上面提到的App client id有问题，但确实帮助我找出了正确的模板。
我已经找到了编写模板的正确方法：
"CognitoIdentityProviders": [
{
"ClientId": {
"Ref": "UserPoolClient"
},
"ProviderName": {
"Fn::GetAtt": [
"UserPool",
"ProviderName"
]
}
}
],
这样，堆栈可以正确创建Identity Pool。
The AWS docs令人困惑：
ProviderName Amazon Cognito用户池的提供程序名称。例如，cognito-idp.us-east-2.amazonaws.com/us-east-2_123456789。