参考 sst (serverless-stack) 在 serverless.yml 中创建的认知用户池

Question

我有一个使用无服务器构建的相当大的应用程序，现在我们正在试用 serverless-stack。我正在尝试引用 sst 在 serverless.yml 函数中创建的用户池。可能吗？以下是我尝试过的步骤：

我已经创建了一个用户池

import * as cdk from '@aws-cdk/core'
import * as cognito from '@aws-cdk/aws-cognito'
import * as sst from '@serverless-stack/resources'

export default class UserServiceStack extends sst.Stack {
  constructor(scope: cdk.Construct, id: string, props: sst.StackProps = {}) {
    super(scope, id, props)

    const userPool = new cognito.UserPool(this, 'userPool', {
      signInAliases: {
        email: true,
        phone: true,
      },
      autoVerify: {
        email: true,
        phone: true,
      },
      passwordPolicy: {
        minLength: 8,
        requireDigits: false,
        requireLowercase: false,
        requireSymbols: false,
        requireUppercase: false,
      },
      signInCaseSensitive: false,
      selfSignUpEnabled: true,
    })

    new cdk.CfnOutput(this, 'UserPoolId', {
      value: userPool.userPoolId,
    })

    const userPoolClient = new cognito.UserPoolClient(this, 'userPoolClient', {
      userPool,
      authFlows: {
        adminUserPassword: true,
        userPassword: true,
      },
    })
    
    new cdk.CfnOutput(this, 'UserPoolClientId', {
      value: userPoolClient.userPoolClientId,
    })
  }
}

并想更新我在 serverless.yml

中定义的 post 确认触发器

  ...
  createUser:
    handler: createUser.default
    events:
      - cognitoUserPool:
          pool: !ImportValue '${self:custom.sstApp}...' # what to put here?
          trigger: PostConfirmation
          existing: true

Answer 1

想通了。首先如何在 serverless.yml.

中使用 cdk 输出变量

将它们导出到文件中

AWS_PROFILE=<profile-name> npx sst deploy --outputs-file ./exports.json

在serverless.yml中你可以像这样引用它

  ...
  createUser:
    handler: createUser.default
    events:
      - cognitoUserPool:
          pool: ${file(../../infrastructure/exports.json):${self:custom.sstApp}-UserServiceStack.userPoolName}
          trigger: PostConfirmation
          existing: true

其次。无服务器设置使得您必须传递 userPoolName，而不是 userPoolId。所以我不得不生成用户池名称并输出它

import * as uuid from 'uuid'

...

    const userPoolName = uuid.v4()
    const userPool = new cognito.UserPool(this, 'userPool', {
      userPoolName,
      ...
    })
    ...
    // eslint-disable-next-line no-new
    new cdk.CfnOutput(this, 'userPoolName', {
      value: userPoolName,
    })

第三，在调用 lambda 作为触发器时避免 AccessDeniedException 你需要将以下内容添加到你的资源中

  - Resources:
      OnCognitoSignupPermission:
        Type: 'AWS::Lambda::Permission'
        Properties:
          Action: "lambda:InvokeFunction"
          FunctionName:
            Fn::GetAtt: [ "CreateUserLambdaFunction", "Arn"] # the name must be uppercased name of your lambda + LambdaFunction at the end
          Principal: "cognito-idp.amazonaws.com"
          SourceArn: ${file(../../infrastructure/exports.json):${self:custom.sstApp}-UserServiceStack.userPoolArn}

参考 sst (serverless-stack) 在 serverless.yml 中创建的认知用户池

reference cognito user pool created by sst (serverless-stack) in serverless.yml

serverless-framework

serverless-stack