feat(cognito): better control sms role creation

[nija-at]

• Introduce a property enableSmsRole that can be used to override CDK
  logic and explicitly enable or disable automatic creation of an IAM role
  for SMS.

• Instead of creating the SMS role by default, all of the time, be smart
  about determining when the role is actually needed. Create the role only
  if (a) SMS is configured as MFA second factor, (b) sign in via phone
  number is enabled, or (c) phone verification is required.

closes #6943

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[iliapolo]

@nija-at Are you comfortable with the integ tests now not covering the SMS role creation? Or is there another one that does? I'm just a little concerned we lost coverage here.

To your discretion, just wanted to mention it. Adding the do-not-merge label for now but feel free to remove and merge.

[iliapolo]

Seems like you can reuse the mfaConfiguration method here:

aws-cdk/packages/@aws-cdk/aws-cognito/lib/user-pool.ts

Lines 875 to 892 in e878f9c

	private mfaConfiguration(props: UserPoolProps): string[] | undefined {
	if (props.mfa === undefined || props.mfa === Mfa.OFF) {
	// since default is OFF, treat undefined and OFF the same way
	return undefined;
	} else if (props.mfaSecondFactor === undefined &&
	(props.mfa === Mfa.OPTIONAL || props.mfa === Mfa.REQUIRED)) {
	return [ 'SMS_MFA' ];
	} else {
	const enabledMfas = [];
	if (props.mfaSecondFactor!.sms) {
	enabledMfas.push('SMS_MFA');
	}
	if (props.mfaSecondFactor!.otp) {
	enabledMfas.push('SOFTWARE_TOKEN_MFA');
	}
	return enabledMfas;
	}
	}

[nija-at]

Good catch. Changed.

[nija-at]

Are you comfortable with the integ tests now not covering the SMS role creation? Or is there another one that does?

These are tested in integ.user-pool-signup* where SMS-based sign up testing is also included.

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 0e208ab
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository