CognitoUserPool

A Cognito user pool with a 12-character password policy, deletion protection and an app client. Add MFA, social login or SAML when you need them.

API & Auth · anvil:aws:CognitoUserPool

Minimal

The smallest config that deploys.

import { App } from '@anvil-cloud/sdk';
import * as anvil from '@anvil-cloud/sdk';

export default new App({
  run(ctx) {
    const users = new anvil.aws.CognitoUserPool('users');
  },
});

import anvil_cloud as anvil

def infra(ctx: anvil.Context):
    users = anvil.aws.CognitoUserPool("users")

anvil.App(run=infra)

package main

import (
    "github.com/anvil-cloud/anvil/sdk/go/anvil"
    anvilaws "github.com/anvil-cloud/anvil/sdk/go/anvil/aws"
)

func main() {
    anvil.Run(anvil.AppConfig{
        Run: func(ctx *anvil.Context) error {
            _, err := anvilaws.NewCognitoUserPool(ctx.PulumiCtx(), "users", nil)
            if err != nil {
                return err
            }
            return nil
        },
    })
}

Good to know

• Users sign in with their email by default. attributes.usernameAttributes and attributes.requiredAttributes can't be changed after the pool is created, so decide them first.
• Passwords need at least 12 characters by default. Change passwordPolicy only to make it stricter.
• Cognito's built-in email sends at most 5 emails a day. Set emailConfiguration.sesFromAddress before going to production.
• Protect API routes with the pool through CognitoAuth.
• AWS recommends a WAF for every public pool: create a Waf with scope: 'regional' in the pool's region and pass it as waf.