Unable to set user pool domain

[antonyfuentes]

Hello!
First off thanks for sharing this terraform module. I've been trying to implement something similar during a couple of days without good look, until I found the awesome work that you did here.
I'm running the terraform module and it is currently failing with an error, so I was wondering if you have any clue about what could be causing it:

`Error: Error creating Cognito User Pool Domain: InvalidParameterException: Custom domain is not a valid subdomain: Was not able to resolve the root domain, please ensure an A record exists for the root domain.
status code: 400, request id: 49da68e8-XXXX....

on modules/secure-site/main.tf line 181, in resource "aws_cognito_user_pool_domain" "secure-site":
181: resource "aws_cognito_user_pool_domain" "secure-site" {`

[paulberg]

Have you tried running the stand alone version and comparing?

Note that the domains must be fully qualified. For instance, I use "private.example.com" as the domain for my site, which is passed in as the "domain" variable and "auth.example.com" as the cognito authentication domain, passed in as the "auth_domain" variable. Passing in just "private" and "auth" as the variables will not work.
The root domain also needs to exist and be hosted in route53 as the module modifies the route53 DNS record for the domain, adding these subdomains, but that does not seem to be the error you are getting.

[paulberg]

Also note that I realized that the cloudfront distribution is heavily georestricted for my own testing. I should change that and parameterize it.

[paulberg]

Take a look at the root of the /terraform directory and look at the vars file as well as the main. You can see how the tld variable, auth_prefix and secure_prefix vars are all set, with tld being the root domain such as "example.com" and auth_prefix being "auth.". Then, main.tf there simply loads the module, and in doing so, concatenates the 2 vars together into "auth.example.com".

[antonyfuentes]

Hi Paul,
Thanks for replying back! so this is my first time playing with Terraform. Do you mind if I share the steps that I'm following? perhaps you can tell me if I'm missing anything:

First I added a file to terraform folder called terraform.tfvars and within that file, I added the following:

Then after that, I cd into the terraform folder and then I run these commands :

• terraform init
• terraform apply

Is that what you call as the stand-alone version? other than that I'm not changing anything else in the terraform folder.
It successfully creates a bunch of objects in AWS (like the private bucket, the lambda function and the cognito resource pool), but at some point fails with that error that I mentioned above.

I registered my domain siriusbinary.net using the route 53 service and then added an ssl certificate to it. Other than that I haven't changed any setting in there. Apart from my root domain should I also create those subdomains manually or the terraform template takes care of that?

Once again, really thanks for your help and sorry if I'm asking too many dumb questions. I'm kind of a newbie to AWS.

[paulberg]

Hmmm... I don't see the issue offhand. I'll try to repro on my end in the morning. The default subdomains should be created by the terraform script and the A records inserted automagically by it. So something seems fishy because the error is flat out saying the domain name is invalid (as in malformed, not that you didn't register it.)

[paulberg]

This might be it: you may need an A record for the root of the domain (siriusbinary.net itself). The terraform does NOT add A records for anything but the cognito user pool subdomain and the subdomain that will host the secure portion (auth. And private. By default.) Because I don't want it messing up the root if you already have something there. The error message seems to indicate that cognito wants the root tld to point to something.

[paulberg]

Docs indicate it too: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html

"A web domain that you own. Its root must have a valid A record in DNS. For more information see Domain Names."

Try that and let me know if it fixes it and I'll add that to the readme.

[paulberg]

Any progress/feedback?

[paulberg]

FYI. For testing, just having an A record for the root domain mapped to 127.0.0.1 appears to satisfy the requirement.

[paulberg]

Closing as there is no further input and I assume it was the above issue.