ipa-stack-cognito

You can deploy a Cognito User Pool with OAuth 2.0 Hosted UI by provisioning a CloudFormation template that configures an App Client for authorization-code flows and a custom domain. This provides JWT-compatible OIDC endpoints ready for application authentication.

Configuring OIDC discovery and JWT validation requires a Cognito User Pool that exports issuer, discovery, and user pool identifiers. These outputs allow API Gateway authorizers and Lambda functions to consistently validate tokens issued by the Hosted UI.

Yes, you can establish a custom domain for the Cognito Hosted UI and apply managed login branding. This ensures users authenticate via your branded experience while using standard OAuth 2.0 authorization-code flows.

Yes, the deployment creates an OAuth 2.0 App Client specifically configured for authorization-code flows. It applies to full-stack serverless builds requiring OIDC discovery and exports user pool, client, issuer, and discovery outputs for downstream wiring.

You parameterize namespace and environment by defining input parameters in your CloudFormation template for the Cognito stack. The deployment validates callback and domain prefix inputs to enforce the specified security posture across different environments.

Validating callback and domain prefix inputs is necessary to enforce the specified security posture during Cognito deployment. It ensures the Hosted UI custom domain and OAuth 2.0 App Client are configured correctly for reliable OIDC token issuance.