How to Set required attributes in aws cognito user pool using aws cloudformation template?

Question

Aws cognito console screen

While creating user-pool using cloudformation template i wanted to add the following attributes(marked in the attached image link). I didn't find anything helpful in the AWS documentation.

It allows setting up Alias attributes as said in the aws cloudformation cognito documentation.

Has anybody tried this or has any idea regarding this?

Answer 1

I managed to get it done using the schema attribute of the AWS::cognito::UserPool:

"myApiUserPool": {
  "Type": "AWS::Cognito::UserPool",
  "Properties": {
    "AdminCreateUserConfig": {
      "AllowAdminCreateUserOnly": true
    },
    "Schema": [
      {
        "Mutable": false,
        "Name": "email",
        "Required": true
      },
      {
        "Mutable": false,
        "Name": "family_name",
        "Required": true
      },
      {
        "Mutable": false,
        "Name": "name",
        "Required": true
      }
    ],
    "AutoVerifiedAttributes": [
      "email"
    ],
    "UserPoolName": {
      "Fn::Sub": "myApiUserPool${envParameter}"
    }
  }
}

Answer 2

Here is the example with YAML.

Note: you cannot just update a attribute you need to delete the userpool and create it again with the new attributes (just comment out your pool section and redeploy it). Otherwise it will ask for a AttributeDataType, and if you include it, it will create a custom attribute instead of standard one.

CognitoUserPool:
  Type: AWS::Cognito::UserPool
  Properties:
    # Generate a name based on the stage
    UserPoolName: ${self:custom.stage}-cfp-user-pool
    AliasAttributes:
      - phone_number
      - email
      - preferred_username
    Policies:
      PasswordPolicy:
        MinimumLength: 8
    Schema:
      - Name: email
        Required: true
        Mutable: true

Answer 3

Adding on @jWang1 and considering you don't want to delete a user pool with lots of active users but you really need to add a parameter during for sign up process, then you can just add a custom attribute to the template and enforce it as required through your authentication library or custom implementation

The minimum parameters to achieve this are:

UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
        Schema:
        -
          Name: <attr name>
          AttributeDataType: Boolean | DateTime | Number | String