[Enhancement]: aws_cognito_user_pool.password_policy.Allow_reuse_of_previous_passwords

[jordancparker]

Description

Request for Allow_reuse_of_previous_passwords to be added to the password_policy in aws_cognito_user_pool resource.

This is a new feature released in Cognito and would make sense to enhance the password_policy as thats where it sits within the UI experience, however there is a requirement for the advanced security to be active.

Affected Resource(s) and/or Data Source(s)

aws_cognito_user_pool

Potential Terraform Configuration

resource "aws_cognito_user_pool" "this" {
  password_policy {
    minimum_length                   = "10"
    require_lowercase                = "true"
    require_numbers                  = "true"
    require_symbols                  = "true"
    require_uppercase                = "true"
    temporary_password_validity_days = "10"
    Allow_reuse_of_previous_passwords = "true"
  }
}

References

No response

Would you like to implement a fix?

No

[github-actions[bot]]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[DizzyDeveloper]

I want to second this issue, with a slight addendum:

resource "aws_cognito_user_pool" "this" {
  password_policy {
    minimum_length                   = "10"
    require_lowercase                = "true"
    require_numbers                  = "true"
    require_symbols                  = "true"
    require_uppercase                = "true"
    temporary_password_validity_days = "10"

    password_history_size = 2 /* Instead of aforementioned Allow_reuse_of_previous_passwords */

  }
}

At the moment this can be achieved by using exec local and manually invoking the the aws cli aws cognito-idp update-user-pool however if miss configure the cli call it will overwrite what was configured as part of the original aws_cognito_user_pool declaration which is not optimal.

[github-actions[bot]]

[!WARNING] This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions[bot]]

This functionality has been released in v5.65.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!