Set account recovery preference for AWS Cognito User Pool with Terraform

Question

In the spirit of infrastructure as code, I've configured an AWS Cognito User Pool via Terraform with the helpful aws_cognito_user_pool resource.

However, I can't seem to locate the argument/config mapping for the account recovery preference under the MFA and verification section.

Without specification, it appears that this is my default selection:

(Not Recommended) Phone if available, otherwise email, and do allow a user to reset their password via phone if they are also using it for MFA.

---

Goal

I'd like to set this to Email only instead, as annotated by the red rectangle in the image below:

Does anyone know what Terraform argument I need to use to achieve this please? None of the options documented in the aws_cognito_user_pool resource seem to map to this.

Answer 1

Hi Peter , I am using the CloudFormation template for creating the Cognito Configuartion.

With a little bit of modification and converting to YAML. We can have the Recovery Settings set to Email only option. Please find the below code snippet.

UserPool:
    Type: "AWS::Cognito::UserPool"
    Properties:
      UserPoolName: "test-pool"
      UsernameAttributes: [email]
      AccountRecoverySetting:
        RecoveryMechanisms:
          - Name: "verified_email"
            Priority: 1
      AutoVerifiedAttributes:
        - email

This seems to be working for me :)

Note: while trying to incorporate the other option for "admin_only" ,AWS geneartes the error Invalid account recovery setting parameter. Account Recovery Setting cannot use admin_only setting with any other recovery mechanisms.

Answer 2

1 year on, I can now answer my own question, due to the newly introduced setting, account_recovery_setting, of the aws_cognito_user_pool resource.

For example, to set the account recovery preference to email only, we can do the following:

resource "aws_cognito_user_pool" "mypool" {
  name = "mypool"

  account_recovery_setting {
    recovery_mechanism {
      name     = "verified_email"
      priority = 1
    }
  }
}

This is available since v3.19.0 of the AWS provider, as part of this merged PR.

Answer 3

Terraform doesn't support it yet. But you could use local exec instead:

resource "null_resource" "setup_account_recovery_settings" {
  triggers = {
    version = "${var.version_local_exec_account_recovery_settings}"
  }

  provisioner "local-exec" {
    command = "aws cognito-idp update-user-pool --user-pool-id ${aws_cognito_user_pool.userpool.id} --account-recovery-setting 'RecoveryMechanisms=[{Priority=1,Name=verified_email},{Priority=2,Name=verified_phone_number}]' --region ${var.region}"
  }
}

But it will wipe out your whole configuration. Instead you could provide full config as a json but why to use terraform than

Answer 4

Following the David's idea, if you want to enable the "email only" option, you should to set

--account-recovery-setting 'RecoveryMechanisms=[{Priority=1,Name=verified_email}]'

Regards,