# Cognito User/Identity Pools as serverless.yml resource defs

**URL:** <https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050>\
**Category:** Serverless Framework\
**Created:** [June 13, 2017, 2:49am UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050 "2017-06-13T02:49:19Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![nerdguru](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/nerdguru/32/248_2.png) [@nerdguru](https://forum.serverless.com/u/nerdguru)\
**Post date:** [June 13, 2017, 2:49am UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/1 "2017-06-13T02:49:19Z")

</div>

I’m having trouble finding an example so forgive me if it’s my search skills that are lacking here, but has anybody sucessfully set up the Resources section in your serverless.yml file to construct User and Identity Pools automatically?

Really, I’m trying to automate what @fanjie and @jayair have done here:

> **[Create a Cognito User Pool](https://serverless-stack.com/chapters/create-a-cognito-user-pool.html)**
>
> Amazon Cognito User Pool handles sign-up and sign-in functionality for web and mobile apps. We are going to create a Cognito User Pool to store and manage the users for our serverless app. We’ll use the email address as username option since we want...

  

> **[Create a Cognito Identity Pool](https://serverless-stack.com/chapters/create-a-cognito-identity-pool.html)**
>
> Amazon Cognito Federated Identities helps us secure our AWS resources. We can use the Cognito User Pool as an identity provider for our serverless backend. To allow users to be able to upload files to our S3 bucket and connect to API Gateway we need...

---

<div class="post-metadata">

**Author:** ![pgali](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/pgali/32/1651_2.png) [@pgali](https://forum.serverless.com/u/pgali)\
**Post date:** [June 15, 2017, 12:14am UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/2 "2017-06-15T00:14:17Z")

</div>

In your serverless yaml file, you can use cloud formation template to create cognito pool as shown below and then you can use the output of the cognito pool how ever you want, in this example, I created an env variable that will be injected to lambda’s.

Hope this helps.

```
 environment:
USER_POOL:
   'Fn::GetAtt': [userPool, Arn]

userPool:
    Type: AWS::Cognito::UserPool
    Properties:
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true
      #AliasAttributes:
      # - String
      #AutoVerifiedAttributes:
      # - String
      #DeviceConfiguration:
      # DeviceConfiguration
      #EmailConfiguration:
      # EmailConfiguration
      #EmailVerificationMessage: String
      #EmailVerificationSubject: String
      #LambdaConfig:
      # LambdaConfig
      #MfaConfiguration: String
      #Policies:
      # Policies
      UserPoolName: ${self:provider.custom.stage}-XXXX
      Schema:
        - AttributeDataType: String
          Mutable: true
          Name: role
      #SmsAuthenticationMessage: String
      #SmsConfiguration:
      # SmsConfiguration
      #SmsVerificationMessage: String
      #UserPoolTags:
      # String: String
```

---

<div class="post-metadata">

**Author:** ![barticus](https://avatars.discourse-cdn.com/v4/letter/b/ac91a4/32.png) [@barticus](https://forum.serverless.com/u/barticus)\
**Post date:** [June 19, 2017, 12:19pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/3 "2017-06-19T12:19:40Z")

</div>

I’m also having trouble with this, I can create the user pool, but I can’t seem to reference the user pool as a cognito provider in the identity pool section, and it fails saying the provider name is wrong.

It’s hard to find sample for these things.

---

<div class="post-metadata">

**Author:** ![nerdguru](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/nerdguru/32/248_2.png) [@nerdguru](https://forum.serverless.com/u/nerdguru)\
**Post date:** [June 22, 2017, 10:05pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/4 "2017-06-22T22:05:00Z")

</div>

> [@pgali](#):
>
> USER\_POOL:  
> ‘Fn::GetAtt’: [userPool, Arn]

That syntax works great for the environment variables, but I’m trying to set the authorizer arn and this:

```
    events:
  - http:
      path: location
      method: post
      cors: true
      authorizer:
        arn: 'Fn::GetAtt': [UserPool, Arn]

```

Fails, I’m guessing in part because of order of operations. What I’d like is for the Resources to generate and then fetch the arn to put as my authorizer.

---

<div class="post-metadata">

**Author:** ![altcatalin](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/altcatalin/32/485_2.png) [@altcatalin](https://forum.serverless.com/u/altcatalin)\
**Post date:** [June 23, 2017, 1:08pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/5 "2017-06-23T13:08:18Z")

</div>

try with ‘Fn::GetAtt’: [UserPool, Arn] on a new line

---

<div class="post-metadata">

**Author:** ![pgali](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/pgali/32/1651_2.png) [@pgali](https://forum.serverless.com/u/pgali)\
**Post date:** [June 23, 2017, 2:41pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/6 "2017-06-23T14:41:15Z")

</div>

You can still reference the environment variable within the authorizer or define the environment variable for that function. Haven’t tried it but try and see what happens.

If there is dependency issue, Cloud Front provides depends on clause you can use that so you can manage the order of resource creation

---

<div class="post-metadata">

**Author:** ![nerdguru](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/nerdguru/32/248_2.png) [@nerdguru](https://forum.serverless.com/u/nerdguru)\
**Post date:** [June 23, 2017, 5:07pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/7 "2017-06-23T17:07:14Z")

</div>

@altcatalin Thanks for the idea, but it still barfs on it on a new line.

@pgali The environment variable can be read in the function no problem, but I’m trying to get the framework to set up the authorizer for me automatically. That may be asking to much, I’m beginning to think 8).

---

<div class="post-metadata">

**Author:** ![altcatalin](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/altcatalin/32/485_2.png) [@altcatalin](https://forum.serverless.com/u/altcatalin)\
**Post date:** [June 23, 2017, 5:36pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/8 "2017-06-23T17:36:50Z")

</div>

have you also tried with the long function form?  
[http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html)

this works

```auto
functions:
  ConsumerFunction:
    ...
    environment:
      QUEUE_ARN:
        Fn::GetAtt:
          - Queue
          - Arn

resources: # CloudFormation template syntax
  Resources:

    # SQS
    Queue:
      Type: AWS::SQS::Queue
      ...

```

---

<div class="post-metadata">

**Author:** ![nerdguru](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/nerdguru/32/248_2.png) [@nerdguru](https://forum.serverless.com/u/nerdguru)\
**Post date:** [June 23, 2017, 8:05pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/9 "2017-06-23T20:05:21Z")

</div>

FYI, just got confirmation that this is a bug that will be fixed as part of a larger ARN issue, workaround described here:

> <https://github.com/serverless/serverless/issues/3212#issuecomment-307341924>
>
> This is a Feature proposal
> Description
> Note: This issue was updated from a bug report to a feature proposal. The implementation of the...

Basically, create your stack once, come back to your serverless.yml and hard code the ARN that gets generated.

---

<div class="post-metadata">

**Author:** ![barticus](https://avatars.discourse-cdn.com/v4/letter/b/ac91a4/32.png) [@barticus](https://forum.serverless.com/u/barticus)\
**Post date:** [June 24, 2017, 10:41am UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/10 "2017-06-24T10:41:02Z")

</div>

I found this gist on github which helped solve a lot of my problems: [https://gist.github.com/singledigit/2c4d7232fa96d9e98a3de89cf6ebe7a5](https://gist.github.com/singledigit/2c4d7232fa96d9e98a3de89cf6ebe7a5)

---

<div class="post-metadata">

**Author:** ![metaheap](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/metaheap/32/905_2.png) [@metaheap](https://forum.serverless.com/u/metaheap)\
**Post date:** [August 23, 2017, 3:36am UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/11 "2017-08-23T03:36:21Z")

</div>

I’ve gotten this to work with text message verification using gist from @barticus… but how it works with email verification I am not sure.

---

<div class="post-metadata">

**Author:** ![iDVB](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/idvb/32/990_2.png) [@iDVB](https://forum.serverless.com/u/iDVB)\
**Post date:** [November 9, 2017, 9:07pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/12 "2017-11-09T21:07:40Z")

</div>

Has anyone found out more about this. I’m looking to do the exact same thing you @nerdguru.

Can’t see to get the authorizer to take in a GetAtt call to the resource. I keep getting the SLS error  
functionArn.split is not a function

---

<div class="post-metadata">

**Author:** ![dan\_b](https://avatars.discourse-cdn.com/v4/letter/d/c2a13f/32.png) [@dan\_b](https://forum.serverless.com/u/dan_b)\
**Post date:** [December 23, 2017, 12:10am UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/13 "2017-12-23T00:10:01Z")

</div>

I was able to get serverless to generate my identity pool using the following:

```
IdentityPool:
  Type: "AWS::Cognito::IdentityPool"
  Properties:
    IdentityPoolName: identitypoolname
    AllowUnauthenticatedIdentities: true
    CognitoIdentityProviders: 
      - ClientId:
          Ref: UserPoolClient
        ProviderName:
          'Fn::GetAtt': [MyUserPool, ProviderName]

```

Hope this helps

---

<div class="post-metadata">

**Author:** ![jonsmirl](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jonsmirl/32/776_2.png) [@jonsmirl](https://forum.serverless.com/u/jonsmirl)\
**Post date:** [December 30, 2017, 3:52pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/14 "2017-12-30T15:52:22Z")

</div>

This will setup userpools that are compatible with aws-amplify

```
service:
  name: digiStatic

frameworkVersion: ">=1.1.0 <2.0.0"

provider:
  name: aws
  runtime: nodejs6.10
  memorySize: 512
  # Serverless variables like ${self:custom.prefix} We use variableSyntax here
  # to change serverless vars to look instead like $<self:custom.prefix>
  variableSyntax: '\$<([:a-zA-Z0-9._,\\-\\/\\(\\)]+?)>'

plugins:
  - serverless-stack-output

custom:
  output:
    handler: scripts/output.handler # Same syntax as you already know
    file: ../stack.json # toml, yaml, yml, and json format is available

resources:
  Resources:

    # Creates a user pool in cognito for your app to auth against

    # Fixme: customer email address needs to be manually entered and verified
    # https://console.aws.amazon.com/ses/home?region=us-east-1#verified-senders-email:

    # Time based MFA can not be enabled from script
    # I have asked AWS to fix this

    UserPool:
      Type: "AWS::Cognito::UserPool"
      Properties:
        UserPoolName: $<self:service>-user-pool
        SmsVerificationMessage: "Your verification code is {####}."
        AutoVerifiedAttributes:
          - email
        MfaConfiguration: "OFF"
        EmailVerificationSubject: "Your Digispeaker verification code"
        EmailVerificationMessage: "Your Digispeaker verification code is {####}."
        SmsAuthenticationMessage: "Your Digispeaker authentication code is {####}."
        Schema:
          - Name: name
            AttributeDataType: String
            Mutable: true
            Required: false
          - Name: email
            AttributeDataType: String
            Mutable: false
            Required: true
          - Name: phone_number
            AttributeDataType: String
            Mutable: true
            Required: false
        Policies:
          PasswordPolicy:
            RequireLowercase: true
            RequireSymbols: false
            RequireNumbers: true
            MinimumLength: 8
            RequireUppercase: true
        AdminCreateUserConfig:
          InviteMessageTemplate:
            EmailMessage: "Your Digispeaker username is {username} and temporary password is {####}."
            EmailSubject: "Your temporary Digispeaker password"
            SMSMessage: "Your Digispeaker username is {username} and temporary password is {####}."
          UnusedAccountValidityDays: 7
          AllowAdminCreateUserOnly: false

    # Creates a User Pool Client to be used by the identity pool
    UserPoolClient:
      Type: "AWS::Cognito::UserPoolClient"
      Properties:
        ClientName: $<self:service>-client
        GenerateSecret: false
        UserPoolId: 
          Ref: UserPool
    
    # Creates a federeated Identity pool
    IdentityPool:
      Type: "AWS::Cognito::IdentityPool"
      Properties:
        IdentityPoolName: $<self:service>Identity
        AllowUnauthenticatedIdentities: true
        CognitoIdentityProviders: 
          - ClientId: 
              Ref: UserPoolClient
            ProviderName:
              'Fn::GetAtt': [UserPool, ProviderName]
        SupportedLoginProviders:
          'graph.facebook.com': "xxxxxxxxxx"
        OpenIdConnectProviderARNs:
          - 'arn:aws:iam::xxxxxxxxxxx:oidc-provider/accounts.google.com'

    # Create a role for unauthorized acces to AWS resources. Very limited access. Only allows users in the previously created Identity Pool
    CognitoUnAuthorizedRole:
      Type: "AWS::IAM::Role"
      Properties:
        AssumeRolePolicyDocument: 
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal: 
                Federated: "cognito-identity.amazonaws.com"
              Action: 
                - "sts:AssumeRoleWithWebIdentity"
              Condition:
                StringEquals: 
                  "cognito-identity.amazonaws.com:aud":
                    Ref: IdentityPool
                "ForAnyValue:StringLike":
                  "cognito-identity.amazonaws.com:amr": unauthenticated
        Policies:
          - PolicyName: "CognitoUnauthorizedPolicy"
            PolicyDocument: 
              Version: "2012-10-17"
              Statement: 
                - Effect: "Allow"
                  Action:
                    - "mobileanalytics:PutEvents"
                    - "cognito-sync:*"
                  Resource: "*"

    # Create a role for authorized acces to AWS resources. Control what your user can access. This example only allows Lambda invokation
    # Only allows users in the previously created Identity Pool
    CognitoAuthorizedRole:
      Type: "AWS::IAM::Role"
      Properties:
        AssumeRolePolicyDocument: 
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal: 
                Federated: "cognito-identity.amazonaws.com"
              Action: 
                - "sts:AssumeRoleWithWebIdentity"
              Condition:
                StringEquals: 
                  "cognito-identity.amazonaws.com:aud":
                    Ref: IdentityPool
                "ForAnyValue:StringLike":
                  "cognito-identity.amazonaws.com:amr": authenticated
        Policies:
          - PolicyName: "CognitoAuthorizedPolicy"
            PolicyDocument: 
              Version: "2012-10-17"
              Statement: 
                - Effect: "Allow"
                  Action:
                    - "mobileanalytics:PutEvents"
                    - "cognito-sync:*"
                    - "cognito-identity:*"
                  Resource: "*"
                - Effect: "Allow"
                  Action:
                    - "lambda:InvokeFunction"
                  Resource: "*"
    
    # Assigns the roles to the Identity Pool
    IdentityPoolRoleMapping:
      Type: "AWS::Cognito::IdentityPoolRoleAttachment"
      Properties:
        IdentityPoolId: 
          Ref: IdentityPool
        Roles:
          authenticated:
              'Fn::GetAtt': [CognitoAuthorizedRole, Arn]
          unauthenticated:
              'Fn::GetAtt': [CognitoUnAuthorizedRole, Arn]

  Outputs:
    UserPoolId:
      Value: 
        Ref: UserPool
      Export:
        Name: "UserPool::Id"
    UserPoolClientId:
      Value:
        Ref: UserPoolClient
      Export:
        Name: "UserPoolClient::Id"
    IdentityPoolId:
      Value:
        Ref: IdentityPool
      Export:
        Name: "IdentityPool::Id"
```

---

<div class="post-metadata">

**Author:** ![jeremyburton](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jeremyburton/32/1539_2.png) [@jeremyburton](https://forum.serverless.com/u/jeremyburton)\
**Post date:** [February 27, 2018, 4:49pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/15 "2018-02-27T16:49:48Z")

</div>

Thanks @jonsmirl - your example has been extremely helpful to me. Any chance you could tell me what I’d need to change to configure the User Pool resource so that it is set up to use the user’s email address as their “username”. I can do this via the AWS console but I want to put this config in serverless.yml.

---

<div class="post-metadata">

**Author:** ![jonsmirl](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jonsmirl/32/776_2.png) [@jonsmirl](https://forum.serverless.com/u/jonsmirl)\
**Post date:** [February 27, 2018, 5:20pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/16 "2018-02-27T17:20:56Z")

</div>

I think you remove the ‘name’ field. But does amplify support that yet? I don’t think they have gotten around to making the userpool stuff configurable yet.

---

<div class="post-metadata">

**Author:** ![jeremyburton](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jeremyburton/32/1539_2.png) [@jeremyburton](https://forum.serverless.com/u/jeremyburton)\
**Post date:** [February 27, 2018, 5:41pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/17 "2018-02-27T17:41:40Z")

</div>

I don’t really know much about amplify. I just want to add the config for my user pool to my serverless service and I was able to take what I needed from your example and use that to create a user pool successfully, just not with the exact config I need.

The ‘name’ field is different to ‘username’ so I don’t think removing that will achieve what I want. Are you able to point me in direction of any docs/tutorials that might help me out? Thanks again!

---

<div class="post-metadata">

**Author:** ![jonsmirl](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jonsmirl/32/776_2.png) [@jonsmirl](https://forum.serverless.com/u/jonsmirl)\
**Post date:** [February 27, 2018, 5:55pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/18 "2018-02-27T17:55:57Z")

</div>

Use the UI to get it the way you like it. Then use the CLI to describe it.

aws cognito-idp describe-user-pool --user-pool-id xxxxxxx

---

<div class="post-metadata">

**Author:** ![jeremyburton](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jeremyburton/32/1539_2.png) [@jeremyburton](https://forum.serverless.com/u/jeremyburton)\
**Post date:** [February 27, 2018, 9:44pm UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/19 "2018-02-27T21:44:57Z")

</div>

Ah ha! Didn’t know I could do that. Thanks, that’s super helpful.

---

<div class="post-metadata">

**Author:** ![supun](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/supun/32/1834_2.png) [@supun](https://forum.serverless.com/u/supun)\
**Post date:** [April 11, 2018, 6:27am UTC](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050/20 "2018-04-11T06:27:49Z")

</div>

hi all  
so i want use cognito pool id use in lambda function.

i try to import UserPool::Id to env varible and then use env varible inside lambda. but its not work  
got a error :circuiler dependency error within serverless deploy

[Next page](https://forum.serverless.com/t/cognito-user-identity-pools-as-serverless-yml-resource-defs/2050.md?page=2)