UserPoolProps Struct
Props for the UserPool construct.
Example
new cognito.UserPool(this, 'myuserpool', {
signInPolicy: {
allowedFirstAuthFactors: { password: true, passkey: true },
},
passkeyRelyingPartyId: 'auth.example.com',
passkeyUserVerification: cognito.PasskeyUserVerification.REQUIRED,
});
Properties
accountRecoveryAccountRecoveryaccount_recoveryAccountRecoveryaccountRecoveryAccountRecoveryAccountRecoveryAccountRecoveryAccountRecoveryAccountRecovery#Default: AccountRecovery.PHONE_WITHOUT_MFA_AND_EMAIL
advancedSecurityModeAdvancedSecurityModeadvanced_security_modeAdvancedSecurityModeadvancedSecurityModeAdvancedSecurityModeAdvancedSecurityModeAdvancedSecurityModeAdvancedSecurityModeAdvancedSecurityModedeprecated#Default: no value
autoVerifyAutoVerifiedAttrsauto_verifyAutoVerifiedAttrsautoVerifyAutoVerifiedAttrsAutoVerifyAutoVerifiedAttrsAutoVerifyAutoVerifiedAttrs#Default: If signInAlias includes email and/or phone, they will be included in autoVerifiedAttributes by default. If absent, no attributes will be auto-verified.
EMAIL and PHONE are the only available options.
customAttributes{ [key: string]: ICustomAttribute }custom_attributestyping.Mapping[str, ICustomAttribute]customAttributesMap<String, ICustomAttribute>CustomAttributesIDictionary<string, ICustomAttribute>CustomAttributes*map[string]ICustomAttribute#Default: No custom attributes.
customSenderKmsKeyIKeyRefcustom_sender_kms_keyIKeyRefcustomSenderKmsKeyIKeyRefCustomSenderKmsKeyIKeyRefCustomSenderKmsKeyIKeyRef#Default: no key ID configured
customThreatProtectionModeCustomThreatProtectionModecustom_threat_protection_modeCustomThreatProtectionModecustomThreatProtectionModeCustomThreatProtectionModeCustomThreatProtectionModeCustomThreatProtectionModeCustomThreatProtectionModeCustomThreatProtectionMode#Default: no value
This feature only functions if your FeaturePlan is set to FeaturePlan.PLUS
deletionProtectionbooleandeletion_protectionbooldeletionProtectionBooleanDeletionProtectionboolDeletionProtection*bool= false#deviceTrackingDeviceTrackingdevice_trackingDeviceTrackingdeviceTrackingDeviceTrackingDeviceTrackingDeviceTrackingDeviceTrackingDeviceTracking#Default: see defaults on each property of DeviceTracking.
Default: cognito will use the default email configuration
Default: CDK will determine based on other properties of the user pool if an SMS role should be created or not.
When left unspecified, CDK will determine based on other properties if a role is needed or not.
featurePlanFeaturePlanfeature_planFeaturePlanfeaturePlanFeaturePlanFeaturePlanFeaturePlanFeaturePlanFeaturePlan#Default: FeaturePlan.ESSENTIALS for a newly created user pool; FeaturePlan.LITE otherwise
This parameter determines the eligibility of the user pool for features like managed login, access-token customization, and threat protection.
keepOriginalKeepOriginalAttrskeep_originalKeepOriginalAttrskeepOriginalKeepOriginalAttrsKeepOriginalKeepOriginalAttrsKeepOriginalKeepOriginalAttrs#Default: Nothing is kept.
EMAIL and PHONE are the only available options.
lambdaTriggersUserPoolTriggerslambda_triggersUserPoolTriggerslambdaTriggersUserPoolTriggersLambdaTriggersUserPoolTriggersLambdaTriggersUserPoolTriggers#Default: No Lambda triggers.
Default: 'Your authentication code is {####}.'
Use '{####}' in the template where Cognito should insert the verification code.
mfaSecondFactorMfaSecondFactormfa_second_factorMfaSecondFactormfaSecondFactorMfaSecondFactorMfaSecondFactorMfaSecondFactorMfaSecondFactorMfaSecondFactor#Default: { sms: true, otp: false, email: false }, if mfa is set to OPTIONAL or REQUIRED. { sms: false, otp: false, email:false }, otherwise
Ignored if mfa is set to OFF.
passkeyRelyingPartyIdstringpasskey_relying_party_idstrpasskeyRelyingPartyIdStringPasskeyRelyingPartyIdstringPasskeyRelyingPartyId*string#Default: No authentication domain
notes
Under the following conditions, the passkey relying party ID must be the fully-qualified domain name of your custom domain:
- The user pool is configured for passkey authentication.
- The user pool has a custom domain, whether or not it also has a prefix domain.
- Your application performs authentication with managed login or the classic hosted UI.
passkeyUserVerificationPasskeyUserVerificationpasskey_user_verificationPasskeyUserVerificationpasskeyUserVerificationPasskeyUserVerificationPasskeyUserVerificationPasskeyUserVerificationPasskeyUserVerificationPasskeyUserVerification#Default: Cognito default setting is PasskeyUserVerification.PREFERRED
You can override other MFA options and require passkey MFA, or you can set it as preferred. When passkey MFA is preferred, the hosted UI encourages users to register a passkey at sign-in.
passwordPolicyPasswordPolicypassword_policyPasswordPolicypasswordPolicyPasswordPolicyPasswordPolicyPasswordPolicyPasswordPolicyPasswordPolicy#Default: see defaults on each property of PasswordPolicy.
removalPolicyRemovalPolicyremoval_policyRemovalPolicyremovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicy= RemovalPolicy.RETAIN#selfSignUpEnabledbooleanself_sign_up_enabledboolselfSignUpEnabledBooleanSelfSignUpEnabledboolSelfSignUpEnabled*bool= false#To configure self sign-up configuration use the userVerification property.
signInAliasesSignInAliasessign_in_aliasesSignInAliasessignInAliasesSignInAliasesSignInAliasesSignInAliasesSignInAliasesSignInAliases#Default: { username: true }
notes
Allows either username with aliases OR sign in with email, phone, or both.
Read the sections on usernames and aliases to learn more - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html
To match with 'Option 1' in the above link, with a verified email, this property should be set to { username: true, email: true }. To match with 'Option 2' in the above link with both a verified email and phone number, this property should be set to { email: true, phone: true }.
signInCaseSensitivebooleansign_in_case_sensitiveboolsignInCaseSensitiveBooleanSignInCaseSensitiveboolSignInCaseSensitive*bool= true#For example, when this option is set to false, users will be able to sign in using either MyUsername or myusername.
signInPolicySignInPolicysign_in_policySignInPolicysignInPolicySignInPolicySignInPolicySignInPolicySignInPolicySignInPolicy#Default: see defaults on each property of SignInPolicy.
Default: a new IAM role is created.
smsRoleExternalIdstringsms_role_external_idstrsmsRoleExternalIdStringSmsRoleExternalIdstringSmsRoleExternalId*string#Default: No external id will be configured.
Learn more about ExternalId here - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html
This property will be ignored if smsRole is not specified.
Default: The same region as the user pool, with a few exceptions - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html#user-pool-sms-settings-first-time
This property will do nothing if SMS configuration is not configured.
standardAttributesStandardAttributesstandard_attributesStandardAttributesstandardAttributesStandardAttributesStandardAttributesStandardAttributesStandardAttributesStandardAttributes#Default: All standard attributes are optional and mutable.
Read more on attributes here - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html
standardThreatProtectionModeStandardThreatProtectionModestandard_threat_protection_modeStandardThreatProtectionModestandardThreatProtectionModeStandardThreatProtectionModeStandardThreatProtectionModeStandardThreatProtectionModeStandardThreatProtectionModeStandardThreatProtectionMode#Default: StandardThreatProtectionMode.NO_ENFORCEMENT
This feature only functions if your FeaturePlan is set to FeaturePlan.PLUS
userInvitationUserInvitationConfiguser_invitationUserInvitationConfiguserInvitationUserInvitationConfigUserInvitationUserInvitationConfigUserInvitationUserInvitationConfig#Default: see defaults in UserInvitationConfig.
Default: automatically generated name by CloudFormation at deploy time.
userVerificationUserVerificationConfiguser_verificationUserVerificationConfiguserVerificationUserVerificationConfigUserVerificationUserVerificationConfigUserVerificationUserVerificationConfig#Default: see defaults in UserVerificationConfig.
Enable or disable self sign-up via the selfSignUpEnabled property.