Cognito: Passwordless authentication support

[ataylorme]

Describe the feature

Support Cognito managed passwordless login as described in this doc

Use Case

I would like to configure Cognito to manage passwordless authentication in my AWS CDK project.

I am stuck on the PoliciesProperty not supporting SignInPolicy

This type is generated from the CloudFormation user pools policy type which is in turn generated from the create user pool request

The create user pool request type is updated but the generated CloudFormation and CDK types stemming from it are not updated.

This seems to be a new feature released on November 22nd, 2024.

I expect auto generated types to be updated 24 hours later.

Proposed Solution

Update Cognito CDK to support the new Congito passwordless authentication features.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

NodeJS aws-cdk-lib 2.170.0

Environment details (OS name and version, etc.)

Node 22

[ataylorme]

I might be missing something in the chain that goes from Cognito API requests to CDK. It looks like the AWS JavaScript SDK method for createUserPool doesn't have the passwordless fields either

I can create things in the console but this negates the benefits of Infrastructure as Code

[pahud]

Thank you for your feature request. To support that, we'll first need CloudFormation support.

Just checked https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-policies.html but unfortunately I can't find relevant support.

Please help the CFN team prioritize by create a feature request at cloudformation-coverage-roadmap, as soon as CFN rolls out the support, CDK should be ready to get it supported as well.

[ataylorme]

I opened #2200 there but I would request that AWS collaborate on support across teams internally.

The burden for starting the process of updating CloudFormation and CDK after Cognito API changes shouldn't fall to users. If anything, AWS can improve internal collaboration so support is launched along side new features, not lagging behind

[BwL1289]

+1. Adding a link to https://github.com/aws-samples/amazon-cognito-passwordless-auth/blob/main/cdk/lib/cognito-passwordless.ts for more context.

[Tietew]

CloudFormation support seems to be shipped.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-signinpolicy.html

L1 construct will be updated in a few days.

[BwL1289]

Once L1 is merged, any ETA on L2 release?

[alexbaileyuk]

Here is an escape hatch until the PR for the L2 construct is merged written for TS:

// Escape hatch for https://github.com/aws/aws-cdk/issues/32265
const cfnPool = userPool.node.defaultChild as CfnUserPool;
cfnPool.policies = {
  ...cfnPool.policies,
  signInPolicy: {
    allowedFirstAuthFactors: ['PASSWORD', 'EMAIL_OTP'],
  }
}