realsensesolutions/AWS Cognito Auth
Provision AWS Cognito User Pool for authentication using Terraform with customizable branding assets
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 11, 2026
- License
- None
Pinned Snippet
uses: realsensesolutions/actions-aws-auth@da7e74c00dedb5ab35c41663e2d8d98f5cec29dc # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| action | Desired outcome: apply, plan or destroy | no | apply |
| name | Cognito User Pool name - will be used as the Name tag | yes | — |
| callback_urls | Comma-separated list of callback URLs for OAuth | no | https://example.com/callback |
| logout_urls | Comma-separated list of logout URLs for OAuth | no | https://example.com |
| allowed_domains | Comma-separated list of allowed email domains for pre-sign-up validation (leave blank to disable) | no | "" |
| enable_managed_login_branding | Enable managed login branding with customizable assets (use background_asset_path, logo_asset_path, favicon_asset_path) | no | false |
| login_position | Login form horizontal position: START, CENTER, or END (only works when enable_managed_login_branding is true) | no | CENTER |
| idp | List of identity providers to enable (e.g., "google", "cognito", or "google\ncognito") | no | cognito |
| google_client_id | Google OAuth 2.0 client ID (required when idp includes "google") | no | "" |
| google_client_secret | Google OAuth 2.0 client secret (required when idp includes "google") | no | "" |
| background_asset_path | Path to background image asset relative to workspace root (supported: png, jpg, jpeg, svg) | no | "" |
| logo_asset_path | Path to logo image asset relative to workspace root (supported: png, jpg, jpeg, svg) | no | "" |
| favicon_asset_path | Path to favicon asset relative to workspace root (supported: ico, png) | no | "" |
| self_registration | Allow users to sign themselves up (true) or require admin to create users (false) | no | false |
| admin_email | Email address for the admin user (if provided, admin user will be created) | no | "" |
| case_sensitive | Whether usernames are case sensitive (true) or case insensitive (false). Default is true (case sensitive) | no | true |
| permissions | List of permissions following Github standard of service: read or write. Supported services: s3, ses, cognito. In YML format (e.g., "s3: write\nses: read\ncognito: write") | no | "" |
Outputs
| name | description |
|---|---|
| user_pool_id | ID of the Cognito User Pool |
| user_pool_arn | ARN of the Cognito User Pool |
| client_id | ID of the Cognito User Pool Client |
| client_secret | Secret of the Cognito User Pool Client |
| user_pool_domain | Domain of the Cognito User Pool |
| login_url | Complete login URL for the Cognito Hosted UI |
| cognito_domain | Cognito provided domain URL |
| managed_login_branding_enabled | Whether managed login branding is enabled |
| managed_login_version | Managed login version used by the domain |
| managed_login_branding_id | ID of the managed login branding resource |
| hosted_ui_url | Complete hosted UI URL for sign-in |
| supported_identity_providers | List of supported identity providers |
| self_registration_enabled | Whether users can sign themselves up |
| admin_user_created | Whether admin user was created (true when admin_email is provided) |
| admin_username | Username of the admin user (if created) |
| cognito_group_name | Name of the Cognito user pool group (if permissions are provided) |
| cognito_group_role_arn | ARN of the IAM role attached to the Cognito group (if permissions are provided) |