feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in)

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

@@ -489,7 +489,7 @@ export interface AuthFactor {
    * @default false
    */
   readonly passkey?: boolean;
-};
+}
 
 /**
  * The user-pool treatment for MFA with a passkey
@@ -500,7 +500,7 @@ export enum PasskeyUserVerification {
   PREFERRED = 'preferred',
   /** Passkey MFA is required */
   REQUIRED = 'required',
-};
+}
 
 /**
  * Email settings for the user pool.
@@ -1105,6 +1105,12 @@ export class UserPool extends UserPoolBase {
     const passwordPolicy = this.configurePasswordPolicy(props);
     const signInPolicy = this.configureSignInPolicy(props);
 
+    if (props.passkeyRelyingPartyId !== undefined && !Token.isUnresolved(props.passkeyRelyingPartyId)) {
+      if (props.passkeyRelyingPartyId.length < 1 || props.passkeyRelyingPartyId.length > 63) {
+        throw new ValidationError(`passkeyRelyingPartyId length must be (inclusively) between 1 and 63, got ${props.passkeyRelyingPartyId.length}`, this);
+      }
+    }
+
     if (props.email && props.emailSettings) {
       throw new ValidationError('you must either provide "email" or "emailSettings", but not both', this);
     }
@@ -1412,10 +1418,7 @@ export class UserPool extends UserPoolBase {
       return undefined;
     }
 
-    if (props.featurePlan === FeaturePlan.LITE) {
-      throw new Error('To enable passwordless sign-in, set `featurePlan` to `FeaturePlan.ESSENTIALS` or `FeaturePlan.PLUS`.');
-    }
-
+    // PASSWORD should be configured as one of the allowed first auth factors.
     const allowedFirstAuthFactors = ['PASSWORD'];
     if (props.allowedFirstAuthFactors.emailOtp) {
       allowedFirstAuthFactors.push('EMAIL_OTP');
@@ -1426,6 +1429,14 @@ export class UserPool extends UserPoolBase {
     if (props.allowedFirstAuthFactors.passkey) {
       allowedFirstAuthFactors.push('WEB_AUTHN');
     }
+    if (allowedFirstAuthFactors.length === 1) {
+      return undefined;
+    }
+
+    if (props.featurePlan === FeaturePlan.LITE) {
+      throw new ValidationError('To enable choice-based authentication, set `featurePlan` to `FeaturePlan.ESSENTIALS` or `FeaturePlan.PLUS`.', this);
+    }
+
     return { allowedFirstAuthFactors };
   }
 

packages/aws-cdk-lib/aws-cognito/test/user-pool.test.ts

@@ -2091,7 +2091,9 @@ describe('User Pool', () => {
     const stack = new Stack();
 
     // WHEN
-    new UserPool(stack, 'Pool', {});
+    new UserPool(stack, 'Pool', {
+      allowedFirstAuthFactors: {},
+    });
 
     // THEN
     Template.fromStack(stack).hasResourceProperties('AWS::Cognito::UserPool', {
@@ -2137,7 +2139,7 @@ describe('User Pool', () => {
         allowedFirstAuthFactors: { emailOtp: true },
         featurePlan: FeaturePlan.LITE,
       });
-    }).toThrow('To enable passwordless sign-in, set `featurePlan` to `FeaturePlan.ESSENTIALS` or `FeaturePlan.PLUS`.');
+    }).toThrow('To enable choice-based authentication, set `featurePlan` to `FeaturePlan.ESSENTIALS` or `FeaturePlan.PLUS`.');
   });
 
   test('passkeyRelyingPartyId is configured', () => {
@@ -2155,6 +2157,26 @@ describe('User Pool', () => {
     });
   });
 
+  test('passkeyRelyingPartyId length must be >= 1', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    expect(() => {
+      new UserPool(stack, 'Pool1', { passkeyRelyingPartyId: '' });
+    }).toThrow('passkeyRelyingPartyId length must be (inclusively) between 1 and 63, got 0');
+  });
+
+  test('passkeyRelyingPartyId length must be <= 63', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    expect(() => {
+      new UserPool(stack, 'Pool2', { passkeyRelyingPartyId: 'x'.repeat(64) });
+    }).toThrow('passkeyRelyingPartyId length must be (inclusively) between 1 and 63, got 64');
+  });
+
   test.each([
     [PasskeyUserVerification.PREFERRED, 'preferred'],
     [PasskeyUserVerification.REQUIRED, 'required'],