aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::Cognito::UserPoolReplica] - [Coverage] - Support Amazon Cognito Multi-Region Replication (MRR)

Open
#2,521 0 comments 10 reactions 0 assignees View on GitHub
Coverage
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::Cognito::UserPool

### Resource name

AWS::Cognito::UserPoolReplica

### Description

## Summary

Amazon Cognito now supports Multi-Region Replication (MRR) for user pools through the API, AWS CLI, and AWS SDKs, but there does not appear to be native AWS CloudFormation support for managing this feature.

The main missing coverage appears to be:

* A new CloudFormation resource type for Cognito user pool replicas, for example `AWS::Cognito::UserPoolReplica`
* CloudFormation support for Cognito custom domain failover routing, equivalent to the `Routing.Failover` configuration available through `UpdateUserPoolDomain`

## Requested CloudFormation coverage

### 1. Add a new resource type

```yaml
Type: AWS::Cognito::UserPoolReplica
```

Suggested properties:

```yaml
Properties:
UserPoolId: String
RegionName: String
Status: String # ACTIVE | INACTIVE
UserPoolTags:
Key: Value
```

This would map to the existing Amazon Cognito APIs:

* `CreateUserPoolReplica`
* `UpdateUserPoolReplica`
* `DeleteUserPoolReplica`
* `ListUserPoolReplicas`

### 2. Add failover routing support to `AWS::Cognito::UserPoolDomain`

Amazon Cognito MRR also requires configuring domain failover through `UpdateUserPoolDomain`.

Suggested CloudFormation support:

```yaml
Type: AWS::Cognito::UserPoolDomain
Properties:
UserPoolId: !Ref UserPool
Domain: auth.example.com
ManagedLoginVersion: 2
CustomDomainConfig:
CertificateArn: arn:aws:acm:us-east-1:111122223333:certificate/example
Routing:
Failover:
SecondaryRegion: us-west-2
PrimaryRoute53HealthCheckId: a1b2c3d4-5678-90ab-cdef-EXAMPLE11111
```

## Use case

We need to manage Amazon Cognito Multi-Region Replication as Infrastructure as Code for disaster recovery and business continuity.

Today, Cognito MRR can be configured with API/CLI/SDK operations, but not fully through CloudFormation. This means teams must either run manual post-deployment commands or create a Lambda-backed CloudFormation custom resource.

Native CloudFormation support would allow teams to:

* Create and manage Cognito user pool replicas through IaC
* Configure custom domain failover through IaC
* Track changes in CloudFormation change sets
* Roll back or update MRR configuration consistently across environments
* Avoid custom Lambda-backed resources for a first-party AWS feature

## Current workaround

The current workaround is to create a Lambda-backed CloudFormation custom resource that calls:

* `CreateUserPoolReplica`
* `UpdateUserPoolReplica`
* `UpdateUserPoolDomain` with `Routing.Failover`

### Other Details

## References

Amazon Cognito Multi-Region replication documentation:
https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-multi-region.html

CreateUserPoolReplica API:
https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolReplica.html

UpdateUserPoolReplica API:
https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolReplica.html

UpdateUserPoolDomain API:
https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolDomain.html

AWS CLI create-user-pool-replica:
https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/create-user-pool-replica.html

AWS SDK for JavaScript v3 CreateUserPoolReplicaCommand:
https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/cognito-identity-provider/command/CreateUserPoolReplicaCommand/

Current CloudFormation Cognito resource list:
https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/AWS_Cognito.html

Current AWS::Cognito::UserPoolDomain CloudFormation reference:
https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cognito-userpooldomain.html

Contributor guide

Open the contributing guide

Research direction

Start with the referenced Cognito APIs—CreateUserPoolReplica, UpdateUserPoolReplica, DeleteUserPoolReplica, ListUserPoolReplicas, and UpdateUserPoolDomain—and compare them with the AWS::Cognito::UserPoolDomain reference. The issue names no repository files or tests, so locate the coverage implementation and resource specification patterns before estimating work. Done means CloudFormation coverage exists for the replica resource and domain failover routing described here.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.