fix(cognito-identitypool-alpha): cannot configure roleMappings with imported userPool and client

packages/@aws-cdk/aws-cognito-identitypool-alpha/README.md

@@ -353,13 +353,18 @@ cannot be references. For example:
 import { UserPool, UserPoolClient } from 'aws-cdk-lib/aws-cognito';
 import { IdentityPoolProviderUrl } from '@aws-cdk/aws-cognito-identitypool-alpha';
 
-declare const userPool: UserPool;
-declare const userPoolClient: UserPoolClient;
+// If you use a previously defined Cognito User Pool, use the `fromUserPoolAttributes` method instead of `fromUserPoolId` or `fromUserPoolArn`.
+const importedPool = UserPool.fromUserPoolAttributes(this, 'ImportedPool', {
+  userPoolId: 'pool-id',
+  userPoolProviderName: 'pool-provider',
+});
+const importedClient = UserPoolClient.fromUserPoolClientId(this, 'ImportedPoolClient', 'client-id');
+
 new IdentityPool(this, 'myidentitypool', {
   identityPoolName: 'myidentitypool',
   roleMappings: [{
     mappingKey: 'cognito',
-    providerUrl: IdentityPoolProviderUrl.userPool(userPool, userPoolClient),
+    providerUrl: IdentityPoolProviderUrl.userPool(importedPool, importedClient),
     useToken: true,
   }],
 });

packages/@aws-cdk/aws-cognito-identitypool-alpha/lib/identitypool.ts

@@ -1,7 +1,7 @@
 import {
   CfnIdentityPool,
-  UserPool,
-  UserPoolClient,
+  IUserPool,
+  IUserPoolClient,
 } from 'aws-cdk-lib/aws-cognito';
 import {
   IOpenIdConnectProvider,
@@ -157,7 +157,7 @@ export class IdentityPoolProviderUrl {
   }
 
   /** User Pool Provider Url */
-  public static userPool(userPool: UserPool, userPoolClient: UserPoolClient): IdentityPoolProviderUrl {
+  public static userPool(userPool: IUserPool, userPoolClient: IUserPoolClient): IdentityPoolProviderUrl {
     const url = `${userPool.userPoolProviderName}:${userPoolClient.userPoolClientId}`;
     return new IdentityPoolProviderUrl(IdentityPoolProviderType.USER_POOL, url);
   }

packages/@aws-cdk/aws-cognito-identitypool-alpha/test/identitypool.test.ts

@@ -3,6 +3,7 @@ import {
 } from 'aws-cdk-lib/assertions';
 import {
   UserPool,
+  UserPoolClient,
   UserPoolIdentityProvider,
 } from 'aws-cdk-lib/aws-cognito';
 import {
@@ -713,4 +714,49 @@ describe('role mappings', () => {
       },
     });
   });
+
+  test('role mapping with a imported user pool and client', () => {
+    const stack = new Stack();
+    const importedPool = UserPool.fromUserPoolAttributes(stack, 'ImportedPool', {
+      userPoolId: 'pool-id',
+      userPoolProviderName: 'pool-provider',
+    });
+    const importedClient = UserPoolClient.fromUserPoolClientId(stack, 'ImportedPoolClient', 'client-id');
+    new IdentityPool(stack, 'TestIdentityPoolRoleMappingRules', {
+      roleMappings: [{
+        mappingKey: 'cognito',
+        providerUrl: IdentityPoolProviderUrl.userPool(importedPool, importedClient),
+        useToken: true,
+      }],
+    });
+    const temp = Template.fromStack(stack);
+    temp.resourceCountIs('AWS::Cognito::IdentityPoolRoleAttachment', 1);
+    temp.hasResourceProperties('AWS::Cognito::IdentityPoolRoleAttachment', {
+      IdentityPoolId: {
+        Ref: 'TestIdentityPoolRoleMappingRulesC8C07BC3',
+      },
+      RoleMappings: {
+        cognito: {
+          IdentityProvider: 'pool-provider:client-id',
+          Type: 'Token',
+        },
+      },
+    });
+  });
+
+  test('role mapping fails when specifying a imported user pool by arn', () => {
+    const stack = new Stack();
+    const pool = UserPool.fromUserPoolArn(stack, 'ImportedPool', 'arn:aws:cognito-idp:us-east-1:0123456789012:userpool/test-user-pool');
+    const client = pool.addClient('Client');
+
+    expect(() => {
+      new IdentityPool(stack, 'TestIdentityPoolRoleMappingRules', {
+        roleMappings: [{
+          mappingKey: 'cognito',
+          providerUrl: IdentityPoolProviderUrl.userPool(pool, client),
+          useToken: true,
+        }],
+      });
+    }).toThrow(/to reference userPoolProviderName, use the `fromUserPoolAttributes`./);
+  });
 });

packages/@aws-cdk/aws-cognito-identitypool-alpha/test/integ.identitypool.js.snapshot/integ-identitypool.template.json

@@ -34,9 +34,6 @@
   "PooltestClientFE8D4935": {
    "Type": "AWS::Cognito::UserPoolClient",
    "Properties": {
-    "UserPoolId": {
-     "Ref": "PoolD3F588B8"
-    },
     "AllowedOAuthFlows": [
      "implicit",
      "code"
@@ -57,17 +54,15 @@
       "Ref": "PoolProviderGoogle76A1E8D0"
      },
      "COGNITO"
-    ]
+    ],
+    "UserPoolId": {
+     "Ref": "PoolD3F588B8"
+    }
    }
   },
   "PoolProviderGoogle76A1E8D0": {
    "Type": "AWS::Cognito::UserPoolIdentityProvider",
    "Properties": {
-    "ProviderName": "Google",
-    "ProviderType": "Google",
-    "UserPoolId": {
-     "Ref": "PoolD3F588B8"
-    },
     "AttributeMapping": {
      "given_name": "given_name",
      "family_name": "family_name",
@@ -79,6 +74,11 @@
      "client_id": "google-client-id",
      "client_secret": "google-client-secret",
      "authorize_scopes": "profile"
+    },
+    "ProviderName": "Google",
+    "ProviderType": "Google",
+    "UserPoolId": {
+     "Ref": "PoolD3F588B8"
     }
    }
   },
@@ -116,9 +116,6 @@
   "OtherPoolUserPoolAuthenticationProviderClient08F670F8": {
    "Type": "AWS::Cognito::UserPoolClient",
    "Properties": {
-    "UserPoolId": {
-     "Ref": "OtherPool7DA7F2F7"
-    },
     "AllowedOAuthFlows": [
      "implicit",
      "code"
@@ -139,17 +136,15 @@
       "Ref": "OtherPoolProviderAmazon4EB0592F"
      },
      "COGNITO"
-    ]
+    ],
+    "UserPoolId": {
+     "Ref": "OtherPool7DA7F2F7"
+    }
    }
   },
   "OtherPoolProviderAmazon4EB0592F": {
    "Type": "AWS::Cognito::UserPoolIdentityProvider",
    "Properties": {
-    "ProviderName": "LoginWithAmazon",
-    "ProviderType": "LoginWithAmazon",
-    "UserPoolId": {
-     "Ref": "OtherPool7DA7F2F7"
-    },
     "AttributeMapping": {
      "given_name": "name",
      "email": "email",
@@ -159,14 +154,76 @@
      "client_id": "amzn-client-id",
      "client_secret": "amzn-client-secret",
      "authorize_scopes": "profile"
+    },
+    "ProviderName": "LoginWithAmazon",
+    "ProviderType": "LoginWithAmazon",
+    "UserPoolId": {
+     "Ref": "OtherPool7DA7F2F7"
+    }
+   }
+  },
+  "UserPoolToImport1A7C21D3": {
+   "Type": "AWS::Cognito::UserPool",
+   "Properties": {
+    "AccountRecoverySetting": {
+     "RecoveryMechanisms": [
+      {
+       "Name": "verified_phone_number",
+       "Priority": 1
+      },
+      {
+       "Name": "verified_email",
+       "Priority": 2
+      }
+     ]
+    },
+    "AdminCreateUserConfig": {
+     "AllowAdminCreateUserOnly": true
+    },
+    "EmailVerificationMessage": "The verification code to your new account is {####}",
+    "EmailVerificationSubject": "Verify your new account",
+    "SmsVerificationMessage": "The verification code to your new account is {####}",
+    "VerificationMessageTemplate": {
+     "DefaultEmailOption": "CONFIRM_WITH_CODE",
+     "EmailMessage": "The verification code to your new account is {####}",
+     "EmailSubject": "Verify your new account",
+     "SmsMessage": "The verification code to your new account is {####}"
+    }
+   },
+   "UpdateReplacePolicy": "Retain",
+   "DeletionPolicy": "Retain"
+  },
+  "UserPoolToImportclientToImport6885CDF7": {
+   "Type": "AWS::Cognito::UserPoolClient",
+   "Properties": {
+    "AllowedOAuthFlows": [
+     "implicit",
+     "code"
+    ],
+    "AllowedOAuthFlowsUserPoolClient": true,
+    "AllowedOAuthScopes": [
+     "profile",
+     "phone",
+     "email",
+     "openid",
+     "aws.cognito.signin.user.admin"
+    ],
+    "CallbackURLs": [
+     "https://example.com"
+    ],
+    "SupportedIdentityProviders": [
+     "COGNITO"
+    ],
+    "UserPoolId": {
+     "Ref": "UserPoolToImport1A7C21D3"
     }
    }
   },
   "identitypoolE2A6D099": {
    "Type": "AWS::Cognito::IdentityPool",
    "Properties": {
-    "AllowUnauthenticatedIdentities": false,
     "AllowClassicFlow": true,
+    "AllowUnauthenticatedIdentities": false,
     "CognitoIdentityProviders": [
      {
       "ClientId": {
@@ -193,6 +250,31 @@
       },
       "ServerSideTokenCheck": true
      },
+     {
+      "ClientId": {
+       "Ref": "UserPoolToImportclientToImport6885CDF7"
+      },
+      "ProviderName": {
+       "Fn::Join": [
+        "",
+        [
+         "cognito-idp.",
+         {
+          "Ref": "AWS::Region"
+         },
+         ".",
+         {
+          "Ref": "AWS::URLSuffix"
+         },
+         "/",
+         {
+          "Ref": "UserPoolToImport1A7C21D3"
+         }
+        ]
+       ]
+      },
+      "ServerSideTokenCheck": true
+     },
      {
       "ClientId": {
        "Ref": "OtherPoolUserPoolAuthenticationProviderClient08F670F8"
@@ -407,6 +489,27 @@
        ]
       },
       "Type": "Token"
+     },
+     "importedUserPool": {
+      "AmbiguousRoleResolution": "Deny",
+      "IdentityProvider": {
+       "Fn::Join": [
+        "",
+        [
+         {
+          "Fn::GetAtt": [
+           "UserPoolToImport1A7C21D3",
+           "ProviderName"
+          ]
+         },
+         ":",
+         {
+          "Ref": "UserPoolToImportclientToImport6885CDF7"
+         }
+        ]
+       ]
+      },
+      "Type": "Token"
      }
     },
     "Roles": {