Modify Amplify-generated Cognito resources with CDK
Amplify Auth provides sensible defaults for the underlying Amazon Cognito resource definitions. You can customize your authentication resource to enable it to behave exactly as needed for your use cases by modifying it directly using AWS Cloud Development Kit (CDK)
Override Cognito UserPool password policies
You can override the password policy by using the L1 cfnUserPool construct and adding a addPropertyOverride.
amplify/backend.ts
import { defineBackend } from '@aws-amplify/backend';import { auth } from './auth/resource';
const backend = defineBackend({ auth,});// extract L1 CfnUserPool resourcesconst { cfnUserPool } = backend.auth.resources.cfnResources;// modify cfnUserPool policies directlycfnUserPool.policies = { passwordPolicy: { minimumLength: 10, requireLowercase: true, requireNumbers: true, requireSymbols: true, requireUppercase: true, temporaryPasswordValidityDays: 20, },};Override Cognito UserPool to enable passwordless sign-in methods
You can modify the underlying Cognito user pool resource to enable sign in with passwordless methods. Learn more about passwordless sign-in methods.
You can also read more about how passwordless authentication flows are implemented in the Cognito documentation.
amplify/backend.ts
import { defineBackend } from "@aws-amplify/backend"import { auth } from "./auth/resource"
const backend = defineBackend({ auth,})
const { cfnResources } = backend.auth.resources;const { cfnUserPool, cfnUserPoolClient } = cfnResources;
// Specify which authentication factors you want to allow with USER_AUTHcfnUserPool.addPropertyOverride( 'Policies.SignInPolicy.AllowedFirstAuthFactors', ['PASSWORD', 'WEB_AUTHN', 'EMAIL_OTP', 'SMS_OTP']);
// The USER_AUTH flow is used for passwordless sign incfnUserPoolClient.explicitAuthFlows = [ 'ALLOW_REFRESH_TOKEN_AUTH', 'ALLOW_USER_AUTH'];
/* Needed for WebAuthn */// The WebAuthnRelyingPartyID is the domain of your relying party, e.g. "example.domain.com"cfnUserPool.addPropertyOverride('WebAuthnRelyingPartyID', '<RELYING_PARTY>');cfnUserPool.addPropertyOverride('WebAuthnUserVerification', 'preferred');