Allow retrieving the generated app client id when creating an ElasticSearch service

[gabp]

As the title mentions, I would like to be able to retrieve the generated app client id so that I can customize the app client when enabling cognito for elastic search.

Use Case

I need this to be able to customize the authentication providers in my identity pool. More specifically, I need to change the authenticated role selection to "Choose role from token" instead of the default option. In cdk, I can do that like this:

new CfnIdentityPoolRoleAttachment(this, 'RoleAttachment', {

        ...

        roleMappings: {

            'app client id here': {
                type: 'Token',
                ambiguousRoleResolution: 'AuthenticatedRole'
            }
        },
        ...
    });

Proposed Solution

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[iliapolo]

Hi @gabp

From AWS ElasticSearch Docs:

When you configure a domain to use Amazon Cognito authentication for Kibana, Amazon ES adds an app client to the user pool and adds the user pool to the identity pool as an authentication provider

It is this app's ID you are referring to correct?

Unfortunately this information is not exposed by the AWS::Elasticsearch::Domain CloudFormation resource.

We encourage you open a request to CloudFormation for this runtime attribute, at which point we can surely add this to the CDK.

In the meanwhile, you can implement this by using Custom Resources.

In a nutshell you need to:

1. Create a lambda function that queries aws cognito and finds that app client.
2. Return the ID as the data of the response.
3. Use getAttr on the custom resource to extract the ID.

You can also seek some guidance in our Gitter channel as well as our StackOverflow tag.

[NGL321]

Hey @gabp,

Reviewing old feature-requests, I see that this never got the Cloudformation update needed. Is this still something you would like to see? If so, we can cut that ticket for you. Please give an update, or we will close this issue for now.

😸 😷

[gabp]

You can close the issue.

…

On Mon, Apr 12, 2021 at 4:59 PM Noah Litov ***@***.***> wrote: Hey @gabp <https://github.com/gabp>, Reviewing old feature-requests, I see that this never got the Cloudformation update needed. Is this still something you would like to see? If so, we can cut that ticket for you. Please give an update, or we will close this issue for now. 😸 😷 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#7119 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABBXDUVSFCLOBRQGHFCPBPDTINNL7ANCNFSM4LZCNVMQ> .

[peterwoodworth]

Thanks for getting back to us! will do

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.