(aws-cognito): support issuer configuration (issuer type) on UserPool
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
Add L2 support for the `IssuerConfiguration` property on `AWS::Cognito::UserPool`. Amazon Cognito recently added the ability to choose the token **issuer type** for a user pool:
- **`ORIGINAL`** — the region-specific issuer URL (`https://cognito-idp..amazonaws.com/`).
- **`UPDATED`** — a multi-Region issuer URL (`https://issuer-cognito-idp..amazonaws.com/`) that serves identical JWKS content across regions for improved resilience/efficiency. Recommended by AWS for all user pools, including multi-Region replication.
The L1 `CfnUserPool` already exposes `IssuerConfiguration` (added via the L1 spec update in #38275), but the L2 `UserPool` construct has no way to set it, so users must drop to an escape hatch.
### Use Case
Teams standardizing on multi-Region resilient Cognito setups (or preparing for multi-Region replication) want to opt into the `UPDATED` issuer that AWS now recommends. Today, an L2 `UserPool` user has to reach into the L1 via `node.defaultChild` to set it, which is not discoverable and breaks the intent-based experience.
### Proposed Solution
Add an optional prop to `UserPoolProps`, mapped to `CfnUserPool.issuerConfiguration`:
```ts
new cognito.UserPool(this, 'Pool', {
issuerType: cognito.UserPoolIssuerType.UPDATED, // ORIGINAL | UPDATED
});
```
- New enum `UserPoolIssuerType` with `ORIGINAL` / `UPDATED`.
- The single-value nested CFN object (`{ Type }`) is flattened to one flat prop per CDK design guidelines.
- Fully backward compatible — omitting it preserves current behavior (no CFN property emitted).
### Other Information
- CFN reference: `AWS::Cognito::UserPool IssuerConfiguration` (`Type: ORIGINAL | UPDATED`).
- The related `KeyConfiguration` (token signing key) property will be proposed/handled separately.
### Acknowledgements
- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### AWS CDK Library version (aws-cdk-lib)
2.x (latest)
### AWS CDK CLI version
2.x (latest)
### Environment details (OS name and version, etc.)
macOS
Contributor guide
Research direction
Start with the aws-cognito UserPoolProps entry point and the existing CfnUserPool. Add the optional issuer setting and verify that ORIGINAL and UPDATED map to the documented IssuerConfiguration values, while omitting the prop preserves current behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100