terraform-aws-saml-cognito

Provisions AWS Cognito resources for connecting SAML authentication.

This gives you a user pool, user pool client, and user pool domain (using a custom domain with a certificate and both A and AAAA records), which can be used with ALB's authentication support.

Usage Example

In order to use this module, you will need to define a us-east-1 provider using the following code:

provider "aws" {
  alias  = "us-east-1"
  region = "us-east-1"
}

Process wise, you'll need to setup and download the SAML Metadata XML file from your chosen IDP, then create the Terraform resources.

Using GSuite for example, you'll use the following configuration values in the GSuite admin:

• ACS URL: https://{dns_name}/saml2/idpresponse
• Entity ID: urn:amazon:cognito:sp:{id} where id is the final component of the Cognito User Pool ARN.
• Name ID Format: EMAIL
• Attribute Mapping:
  • Add a value named email which maps to Primary Email

module "saml_cognito" {
  source = "trussworks/saml-cognito/aws"

  name                                   = "GSuiteSAML"
  dns_name                               = "cognito-sso.my-corp.com"
  zone_id                                = aws_route53_zone.my_corp.zone_id
  saml_metadata_file_content             = file("cognito-gsuite-saml-metadata.xml")
  saml_metadata_sso_redirect_binding_uri = "https://accounts.google.com/o/saml2/idp?idpid=<id>"
  relying_party_dns_names                = ["my-app.int.my-corp.com", "my-other-app.int.my-corp.com"]

  providers = {
    aws           = aws
    aws.us-east-1 = aws.us-east-1
  }
}

This will leave you with Cognito resources, that use https://cognito-sso.my-corp.com as the domain that is a RP for the GSuite SAML IDP. It can be used to provide authentication for apps running on the domains my-app.int.my-corp.com and my-other-app.int.my-corp.com.

Requirements

Providers

Modules

Resources

Inputs

Outputs

Attribution

This module has been based on alloy-commons/alloy-open-source