fix(cognito/userpool)!: MFA not always working

apis/cognitoidentityprovider/generator-config.yaml

@@ -13,8 +13,14 @@ ignore:
     - CreateIdentityProviderInput.UserPoolId
     - CreateIdentityProviderInput.ProviderDetails
     - CreateIdentityProviderOutput.IdentityProvider.ProviderDetails
+    - CreateUserPoolInput.AdminCreateUserConfig.UnusedAccountValidityDays
 resources:
   UserPool:
+    fields:
+      SoftwareTokenMfaConfiguration:
+        from:
+          operation: SetUserPoolMfaConfig
+          path: SoftwareTokenMfaConfiguration
     exceptions:
       errors:
         # In the API this is a 400 error, but we have to define a 404 error here,

examples/cognito/userpool.yaml

@@ -6,5 +6,34 @@ spec:
   forProvider:
     region: us-east-1
     poolName: examplePool
+    # "After you create a user pool, you can't change or remove sign-in options.":
+    # concerns aliasAttributes, usernameAttributes, UsernameConfiguration
+    # "Only one of the aliasAttributes or usernameAttributes can be set in a User pool."
+    # if aliasAttributes used, seems to add these additionally to username as sign-in options.
+    # In contrast using usernameAttributes seems to replace username as sign-in option!
+    aliasAttributes: 
+      - email
+      - phone_number
+      - preferred_username
+    usernameConfiguration: # default is true
+      caseSensitive: false
+    adminCreateUserConfig:
+      allowAdminCreateUserOnly: true
+      inviteMessageTemplate:
+        emailMessage: |
+          Your username is:
+          <br>{username}<br>
+          <br>and your temporary password is:
+          <br>{####}<br>
+        # ensure that for email subject line a single-line string is provided
+        emailSubject: "Your temporary password"
+    mfaConfiguration: 'ON'
+    # to make MFA usable, either softwareTokenMFAConfiguration
+    # and/or smsConfiguration (with externalID) needs to be provided
+    softwareTokenMFAConfiguration:
+      enabled: true
+    userPoolTags:
+      pool: big
+      users: best
   providerConfigRef:
     name: example

package/crds/cognitoidentityprovider.aws.crossplane.io_userpools.yaml

@@ -98,9 +98,6 @@ spec:
                           sMSMessage:
                             type: string
                         type: object
-                      unusedAccountValidityDays:
-                        format: int64
-                        type: integer
                     type: object
                   aliasAttributes:
                     description: 'Attributes supported as an alias for this user pool.
@@ -287,6 +284,12 @@ spec:
                   smsVerificationMessage:
                     description: A string representing the SMS verification message.
                     type: string
+                  softwareTokenMFAConfiguration:
+                    description: The software token MFA configuration.
+                    properties:
+                      enabled:
+                        type: boolean
+                    type: object
                   userPoolAddOns:
                     description: Enables advanced security risk detection. Set the
                       key AdvancedSecurityMode to the value "AUDIT".

pkg/clients/cognitoidentityprovider/fake/fake.go

@@ -0,0 +1,70 @@
+/*
+Copyright 2021 The Crossplane Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fake
+
+import (
+	"context"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
+	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider/cognitoidentityprovideriface"
+)
+
+// MockCognitoIdentityProviderClient for testing
+type MockCognitoIdentityProviderClient struct {
+	cognitoidentityprovideriface.CognitoIdentityProviderAPI
+
+	MockGetUserPoolMfaConfig            func(*cognitoidentityprovider.GetUserPoolMfaConfigInput) (*cognitoidentityprovider.GetUserPoolMfaConfigOutput, error)
+	MockSetUserPoolMfaConfigWithContext func(context.Context, *cognitoidentityprovider.SetUserPoolMfaConfigInput, []request.Option) (*cognitoidentityprovider.SetUserPoolMfaConfigOutput, error)
+
+	Called MockCognitoIdentityProviderClientCall
+}
+
+// CallGetUserPoolMfaConfig to log call
+type CallGetUserPoolMfaConfig struct {
+	Ctx  aws.Context
+	I    *cognitoidentityprovider.GetUserPoolMfaConfigInput
+	Opts []request.Option
+}
+
+// GetUserPoolMfaConfig calls MockGetUserPoolMfaConfig
+func (m *MockCognitoIdentityProviderClient) GetUserPoolMfaConfig(i *cognitoidentityprovider.GetUserPoolMfaConfigInput) (*cognitoidentityprovider.GetUserPoolMfaConfigOutput, error) {
+	m.Called.GetUserPoolMfaConfig = append(m.Called.GetUserPoolMfaConfig, &CallGetUserPoolMfaConfig{I: i})
+
+	return m.MockGetUserPoolMfaConfig(i)
+}
+
+// CallSetUserPoolMfaConfigWithContext to log call
+type CallSetUserPoolMfaConfigWithContext struct {
+	Ctx  aws.Context
+	I    *cognitoidentityprovider.SetUserPoolMfaConfigInput
+	Opts []request.Option
+}
+
+// SetUserPoolMfaConfigWithContext calls MockSetUserPoolMfaConfigWithContext
+func (m *MockCognitoIdentityProviderClient) SetUserPoolMfaConfigWithContext(ctx context.Context, i *cognitoidentityprovider.SetUserPoolMfaConfigInput, opts ...request.Option) (*cognitoidentityprovider.SetUserPoolMfaConfigOutput, error) {
+	m.Called.SetUserPoolMfaConfigWithContext = append(m.Called.SetUserPoolMfaConfigWithContext, &CallSetUserPoolMfaConfigWithContext{Ctx: ctx, I: i, Opts: opts})
+
+	return m.MockSetUserPoolMfaConfigWithContext(ctx, i, opts)
+}
+
+// MockCognitoIdentityProviderClientCall to log calls
+type MockCognitoIdentityProviderClientCall struct {
+	GetUserPoolMfaConfig            []*CallGetUserPoolMfaConfig
+	SetUserPoolMfaConfigWithContext []*CallSetUserPoolMfaConfigWithContext
+}