aws / aws/aws-cdk

(aws-cognito): support issuer configuration (issuer type) on UserPool

Open
#38,286 7 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-cognito effort/small feature-request mixins p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Add L2 support for the `IssuerConfiguration` property on `AWS::Cognito::UserPool`. Amazon Cognito recently added the ability to choose the token **issuer type** for a user pool:

- **`ORIGINAL`** — the region-specific issuer URL (`https://cognito-idp..amazonaws.com/`).
- **`UPDATED`** — a multi-Region issuer URL (`https://issuer-cognito-idp..amazonaws.com/`) that serves identical JWKS content across regions for improved resilience/efficiency. Recommended by AWS for all user pools, including multi-Region replication.

The L1 `CfnUserPool` already exposes `IssuerConfiguration` (added via the L1 spec update in #38275), but the L2 `UserPool` construct has no way to set it, so users must drop to an escape hatch.

### Use Case

Teams standardizing on multi-Region resilient Cognito setups (or preparing for multi-Region replication) want to opt into the `UPDATED` issuer that AWS now recommends. Today, an L2 `UserPool` user has to reach into the L1 via `node.defaultChild` to set it, which is not discoverable and breaks the intent-based experience.

### Proposed Solution

Add an optional prop to `UserPoolProps`, mapped to `CfnUserPool.issuerConfiguration`:

```ts
new cognito.UserPool(this, 'Pool', {
issuerType: cognito.UserPoolIssuerType.UPDATED, // ORIGINAL | UPDATED
});
```

- New enum `UserPoolIssuerType` with `ORIGINAL` / `UPDATED`.
- The single-value nested CFN object (`{ Type }`) is flattened to one flat prop per CDK design guidelines.
- Fully backward compatible — omitting it preserves current behavior (no CFN property emitted).

### Other Information

- CFN reference: `AWS::Cognito::UserPool IssuerConfiguration` (`Type: ORIGINAL | UPDATED`).
- The related `KeyConfiguration` (token signing key) property will be proposed/handled separately.

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.x (latest)

### AWS CDK CLI version

2.x (latest)

### Environment details (OS name and version, etc.)

macOS

Contributor guide

Open the contributing guide

Research direction

Start with the aws-cognito UserPoolProps entry point and the existing CfnUserPool. Add the optional issuer setting and verify that ORIGINAL and UPDATED map to the documented IssuerConfiguration values, while omitting the prop preserves current behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.