在 serverless.yml 中引用 sst (serverless-stack) 创建的 cognito 用户池答案

【问题标题】：reference cognito user pool created by sst (serverless-stack) in serverless.yml在 serverless.yml 中引用 sst (serverless-stack) 创建的 cognito 用户池
【发布时间】：2021-07-08 01:28:06
【问题描述】：

我有一个使用无服务器构建的大型应用程序，现在我们正在尝试serverless-stack。我试图在 serverless.yml 函数中引用由 sst 创建的用户池。可能吗？以下是我尝试过的步骤：

我已经创建了一个用户池

import * as cdk from '@aws-cdk/core'
import * as cognito from '@aws-cdk/aws-cognito'
import * as sst from '@serverless-stack/resources'

export default class UserServiceStack extends sst.Stack {
  constructor(scope: cdk.Construct, id: string, props: sst.StackProps = {}) {
    super(scope, id, props)

    const userPool = new cognito.UserPool(this, 'userPool', {
      signInAliases: {
        email: true,
        phone: true,
      },
      autoVerify: {
        email: true,
        phone: true,
      },
      passwordPolicy: {
        minLength: 8,
        requireDigits: false,
        requireLowercase: false,
        requireSymbols: false,
        requireUppercase: false,
      },
      signInCaseSensitive: false,
      selfSignUpEnabled: true,
    })

    new cdk.CfnOutput(this, 'UserPoolId', {
      value: userPool.userPoolId,
    })

    const userPoolClient = new cognito.UserPoolClient(this, 'userPoolClient', {
      userPool,
      authFlows: {
        adminUserPassword: true,
        userPassword: true,
      },
    })
    
    new cdk.CfnOutput(this, 'UserPoolClientId', {
      value: userPoolClient.userPoolClientId,
    })
  }
}

并且想要更新我在serverless.yml 中定义的发布确认触发器

  ...
  createUser:
    handler: createUser.default
    events:
      - cognitoUserPool:
          pool: !ImportValue '${self:custom.sstApp}...' # what to put here?
          trigger: PostConfirmation
          existing: true

【问题讨论】：

标签： serverless-framework serverless-stack

【解决方案1】：

想通了。首先如何在serverless.yml中使用cdk输出变量。

将它们导出到文件中

AWS_PROFILE=<profile-name> npx sst deploy --outputs-file ./exports.json

在serverless.yml 你可以这样引用它

  ...
  createUser:
    handler: createUser.default
    events:
      - cognitoUserPool:
          pool: ${file(../../infrastructure/exports.json):${self:custom.sstApp}-UserServiceStack.userPoolName}
          trigger: PostConfirmation
          existing: true

第二。设置无服务器，因此您必须传递 userPoolName，而不是 userPoolId。所以我必须生成用户池名称并输出它

import * as uuid from 'uuid'

...

    const userPoolName = uuid.v4()
    const userPool = new cognito.UserPool(this, 'userPool', {
      userPoolName,
      ...
    })
    ...
    // eslint-disable-next-line no-new
    new cdk.CfnOutput(this, 'userPoolName', {
      value: userPoolName,
    })

为了避免在调用 lambda 作为触发器时出现 AccessDeniedException，您需要将以下内容添加到资源中

  - Resources:
      OnCognitoSignupPermission:
        Type: 'AWS::Lambda::Permission'
        Properties:
          Action: "lambda:InvokeFunction"
          FunctionName:
            Fn::GetAtt: [ "CreateUserLambdaFunction", "Arn"] # the name must be uppercased name of your lambda + LambdaFunction at the end
          Principal: "cognito-idp.amazonaws.com"
          SourceArn: ${file(../../infrastructure/exports.json):${self:custom.sstApp}-UserServiceStack.userPoolArn}

【讨论】：