[アップデート] Amazon Cognito User pool の多要素認証に E メールを利用可能になったので AWS CDK で設定してみた

npm i aws-cdk-lib@latest aws-cdk@latest

import * as cdk from 'aws-cdk-lib';
import * as cognito from 'aws-cdk-lib/aws-cognito';
import { Construct } from 'constructs';

export class Main2Stack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    const region = this.region;

    const COGNITO_FROM_EMAIL_DOMAIN_NAME = process.env.DOMAIN_NAME || '';
    const COGNITO_DOMAIN_PREFIX = 'cm-test-20241110';
    const CALLBACK_URLS = ['https://dev.classmethod.jp/'];
    const LOGOUT_URLS = ['https://dev.classmethod.jp/'];
    const TEST_USER_EMAIL_ADDRESS = process.env.TEST_USER_EMAIL_ADDRESS || '';

    /**
     * Cognito User Pool
     */
    const userPool = new cognito.UserPool(this, 'UserPool', {
      selfSignUpEnabled: true,
      signInAliases: {
        email: true,
      },
      autoVerify: {
        email: true,
      },
      // 前提1: メールプロバイダーとして SES が設定されていること
      email: cognito.UserPoolEmail.withSES({
        sesRegion: region, // CDK 上ではオプションだが、実際には指定必須
        fromEmail: `noreply@${COGNITO_FROM_EMAIL_DOMAIN_NAME}`,
      }),
      mfa: cognito.Mfa.REQUIRED,
      mfaSecondFactor: {
        sms: true,
        otp: false,
        email: true, // e-mail による MFA の有効化
      },
      // 前提2: 高度なセキュリティ機能が有効化されていること
      advancedSecurityMode: cognito.AdvancedSecurityMode.ENFORCED,
      removalPolicy: cdk.RemovalPolicy.DESTROY, // 検証用リソースのため削除を許可
    });

    /**
     * Cognito User Pool Domain
     */
    userPool.addDomain('UserPoolDomain', {
      cognitoDomain: { domainPrefix: COGNITO_DOMAIN_PREFIX },
    });

    /**
     * Cognito User Pool Client
     */
    userPool.addClient('UserPoolClient', {
      generateSecret: false,
      oAuth: {
        callbackUrls: CALLBACK_URLS,
        logoutUrls: LOGOUT_URLS,
        flows: { authorizationCodeGrant: true },
      },
    });

    /**
     * Cognito User Pool User
     * 動作確認用のユーザーを作成
     */
    const userPoolUser = new cognito.CfnUserPoolUser(this, 'UserPoolUser', {
      userPoolId: userPool.userPoolId,
      username: TEST_USER_EMAIL_ADDRESS,
    });
    userPoolUser.node.addDependency(userPool);
  }
}

$  npm run deploy

> [email protected] deploy
> cdk deploy --require-approval never --method=direct


✨  Synthesis time: 5.41s

Main: deploying... [1/1]
Main: updating stack...
5:17:52 PM | UPDATE_FAILED        | AWS::Cognito::UserPool       | MyUserPoolD09D1D74
Resource handler returned message: "Cognito received the following error from Amazon SES when attempting to send email: Email address is not verified. The following identities failed the check in region AP-NORTHEAST-1: ar
n:aws:ses:ap-northeast-1:XXXXXXXXXXXX:identity/[email protected] (Service: CognitoIdentityProvider, Status Code: 400, Request ID: 7061cfbb-a6ff-4bb6-9382-b7fe47b22241)" (RequestToken: c57a9893-597f-de1
e-b300-54c21483eb48, HandlerErrorCode: InvalidRequest)

❌  Main failed: The stack named Main failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Cognito received the following error from Amazon SES when attempting to send email: Email address is not verified. The following identities failed the check in region AP-NORTHEAST-1: arn:aws:ses:ap-northeast-1:XXXXXXXXXXXX:identity/[email protected] (Service: CognitoIdentityProvider, Status Code: 400, Request ID: 7061cfbb-a6ff-4bb6-9382-b7fe47b22241)" (RequestToken: c57a9893-597f-de1e-b300-54c21483eb48, HandlerErrorCode: InvalidRequest)

$ npm run deploy -- Main2

> [email protected] deploy
> cdk deploy --require-approval never --method=direct Main2


✨  Synthesis time: 5.55s

Main2: start: Building 92788324c5fdf7bdf48905d6c954c3eee5acc57ef34779f164579f917c87b6a0:current_account-current_region
Main2: success: Built 92788324c5fdf7bdf48905d6c954c3eee5acc57ef34779f164579f917c87b6a0:current_account-current_region
Main2: start: Publishing 92788324c5fdf7bdf48905d6c954c3eee5acc57ef34779f164579f917c87b6a0:current_account-current_region
Main2: success: Published 92788324c5fdf7bdf48905d6c954c3eee5acc57ef34779f164579f917c87b6a0:current_account-current_region
Main2: deploying... [1/1]
Main2: creating stack...
8:14:37 PM | CREATE_FAILED        | AWS::Cognito::UserPool       | MyUserPool
Resource handler returned message: "SMS configuration and Auto verification for phone_number are required when MFA is required/optional (Service: CognitoIdentityProvider, Status Code: 400,
Request ID: 342f39fa-f7e7-4da6-8673-9feb85b00a71)" (RequestToken: 6d2d35ec-4994-e991-df00-34eb306ed79c, HandlerErrorCode: InvalidRequest)

      mfaSecondFactor: {
        sms: true, // 有効である必要がある
        otp: true,
        email: true,
      },

      // 略
      mfaSecondFactor: {
        sms: false, // SMS 認証を無効化
        otp: false,
        email: true, // e-mail による MFA の有効化
      },
      // 略