Import home-unite-us production Cognito

[ale210]

First of three PRs for #166. This one only adopts the production Cognito stack into state — no infrastructure changes.

What this does

• Renames cognito.tf to cognito-qa.tf. Terraform keys state on resource addresses rather than filenames, so the rename alone changes nothing.
• Adds cognito-prod.tf, declaring the production pool Home Unite Us (us-west-2_VH24AGQ3p) and its client, domain, four user groups, Google identity provider, SMS role and inline policy, and the homeuniteus-cognito-client secret.
• Adds the matching import blocks to terraform/import.tf, following the pattern from Bring civictechindex's AWS resources under Terraform #165.

Why import rather than rebuild

The production pool holds the live user accounts, and its pool id and client id are compiled into the running production container image. Rebuilding it would mean migrating users, which Cognito does not support without resetting passwords. The home-unite-us pool already in Terraform is a separate pool that only serves qa1.homeunite.us — both are real, and neither replaces the other.

The ECS service is the opposite case and is handled separately: it holds no state, so it gets recreated with the correct naming rather than imported.

The check that matters

No resource may be added, destroyed or replaced. That is the point of this PR — it proves the adoption is inert before anything else touches production. The provider sets default_tags, so a truly empty plan is not achievable: every imported resource gains managed-by = terraform-incubator, which is exactly the tag the coverage report reads. The bar is therefore that every change is tags or Terraform-side metadata, and nothing is created or replaced.

Current plan: 11 to import, 0 to add, 4 to change, 0 to destroy. The four changes are tags_all gaining managed-by on the pool, the IAM role and the secret; provider defaults (recovery_window_in_days, force_overwrite_replica_secret) being recorded for the secret; and the Google provider's client_id/client_secret being re-marked as sensitive, which the plan explicitly annotates as "The value is unchanged".

Two defects the first plan caught, both fixed in the second commit:

• The user pool client planned as a replacement. generate_secret cannot be read back from the API, so Terraform saw null → true and that attribute forces replacement. Replacing the client would mint a new client id, which is compiled into the production frontend bundle — it would have broken sign-in. Fixed with ignore_changes = [generate_secret], plus prevent_destroy so any future replacement fails loudly instead.
• Three of the four user groups planned as creates. Terraform honours only one import block per resource address, so four static blocks left three instances unimported. Fixed by collapsing them into a single for_each import block.

Three further details were needed to get the plan this clean, each commented in the file:

• user_pool_tier = "LITE" is set explicitly. The pool predates the tier feature; the provider defaults the attribute to ESSENTIALS, so omitting it would plan a billing upgrade on the live pool.
• lambda_config names the legacy customMessage and mergeUsers by literal ARN. Those stay unmanaged deliberately — re-pointing the pool at the already-managed home-unite-us-* pair is a live change to production sign-up and belongs in its own change.
• Only the secret container is managed, not its version, so Terraform cannot rewrite the stored client secret.

The Google identity provider reads the same secrets as the QA one. The legacy homeuniteus-google-* pair holds byte-identical values, verified by digest, so they are redundant copies rather than separate credentials and are left for the cleanup PR.

Verification

• terraform fmt clean, terraform validate passes on 1.16.0.
• A local plan was not possible — the state was written by 1.16.0 and the pinned constraint is ~> 1.16.0, so CI is the first real plan.
• After this merges, confirm sign-in still works at qa.homeunite.us, which is the production hostname the current image is built against.

Not in this PR

The production ECS service, the cutover, and deleting the legacy resources. The Lambda re-point is tracked as follow-on work.

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

Plan: 11 to import, 0 to add, 4 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # module.home-unite-us.aws_cognito_identity_provider.google_client_prod will be updated in-place
  # (imported from "us-west-2_VH24AGQ3p:Google")
!~  resource "aws_cognito_identity_provider" "google_client_prod" {
        attribute_mapping = {
            "birthdate"    = "birthdays"
            "email"        = "email"
            "family_name"  = "family_name"
            "gender"       = "genders"
            "given_name"   = "given_name"
            "name"         = "names"
            "phone_number" = "phoneNumbers"
            "picture"      = "picture"
            "username"     = "sub"
        }
        id                = "us-west-2_VH24AGQ3p:Google"
        idp_identifiers   = []
!~      provider_details  = {
            "attributes_url"                = "https://people.googleapis.com/v1/people/me?personFields="
            "attributes_url_add_attributes" = "true"
            "authorize_scopes"              = "email profile openid"
            "authorize_url"                 = "https://accounts.google.com/o/oauth2/v2/auth"
          # Warning: this attribute value will be marked as sensitive and will not
          # display in UI output after applying this change. The value is unchanged.
!~          "client_id"                     = (sensitive value)
          # Warning: this attribute value will be marked as sensitive and will not
          # display in UI output after applying this change. The value is unchanged.
!~          "client_secret"                 = (sensitive value)
            "oidc_issuer"                   = "https://accounts.google.com"
            "token_request_method"          = "****"
            "token_url"                     = "******************************************"
        }
        provider_name     = "Google"
        provider_type     = "Google"
        region            = "us-west-2"
        user_pool_id      = "*******************"
    }

  # module.home-unite-us.aws_cognito_user_group.homeuniteus_prod["Admins"] will be imported
    resource "aws_cognito_user_group" "homeuniteus_prod" {
        description  = "Managed by Terraform"
        id           = "us-west-2_VH24AGQ3p/Admins"
        name         = "Admins"
        precedence   = 0
        region       = "us-west-2"
        role_arn     = null
        user_pool_id = "*******************"
    }

  # module.home-unite-us.aws_cognito_user_group.homeuniteus_prod["Coordinators"] will be imported
    resource "aws_cognito_user_group" "homeuniteus_prod" {
        description  = "Managed by Terraform"
        id           = "us-west-2_VH24AGQ3p/Coordinators"
        name         = "Coordinators"
        precedence   = 0
        region       = "us-west-2"
        role_arn     = null
        user_pool_id = "*******************"
    }

  # module.home-unite-us.aws_cognito_user_group.homeuniteus_prod["Guests"] will be imported
    resource "aws_cognito_user_group" "homeuniteus_prod" {
        description  = "Managed by Terraform"
        id           = "us-west-2_VH24AGQ3p/Guests"
        name         = "Guests"
        precedence   = 0
        region       = "us-west-2"
        role_arn     = null
        user_pool_id = "*******************"
    }

  # module.home-unite-us.aws_cognito_user_group.homeuniteus_prod["Hosts"] will be imported
    resource "aws_cognito_user_group" "homeuniteus_prod" {
        description  = "Managed by Terraform"
        id           = "us-west-2_VH24AGQ3p/Hosts"
        name         = "Hosts"
        precedence   = 0
        region       = "us-west-2"
        role_arn     = null
        user_pool_id = "*******************"
    }

  # module.home-unite-us.aws_cognito_user_pool.homeuniteus_prod will be updated in-place
  # (imported from "us-west-2_VH24AGQ3p")
!~  resource "aws_cognito_user_pool" "homeuniteus_prod" {
        arn                        = "arn:aws:cognito-idp:us-west-2:035866691871:userpool/us-west-2_VH24AGQ3p"
        auto_verified_attributes   = [
            "email",
        ]
        creation_date              = "2024-10-08T09:26:17Z"
        custom_domain              = null
        deletion_protection        = "ACTIVE"
        domain                     = "homeuniteus"
        email_verification_message = null
        email_verification_subject = null
        endpoint                   = "cognito-idp.us-west-2.amazonaws.com/us-west-2_VH24AGQ3p"
        estimated_number_of_users  = 96
        id                         = "us-west-2_VH24AGQ3p"
        last_modified_date         = "2024-10-08T09:26:18Z"
        mfa_configuration          = "OPTIONAL"
        name                       = "Home Unite Us"
        region                     = "us-west-2"
        sms_authentication_message = null
        sms_verification_message   = null
        tags                       = {}
!~      tags_all                   = {
+           "managed-by" = "terraform-incubator"
        }
        user_pool_tier             = "LITE"
        username_attributes        = [
            "email",
            "phone_number",
        ]

        account_recovery_setting {
            recovery_mechanism {
                name     = "verified_email"
                priority = 1
            }
            recovery_mechanism {
                name     = "verified_phone_number"
                priority = 2
            }
        }

        admin_create_user_config {
            allow_admin_create_user_only = false
        }

        email_configuration {
            configuration_set      = null
            email_sending_account  = "COGNITO_DEFAULT"
            from_email_address     = null
            reply_to_email_address = null
            source_arn             = null
        }

        lambda_config {
            create_auth_challenge          = null
            custom_message                 = "arn:aws:lambda:us-west-2:035866691871:function:customMessage"
            define_auth_challenge          = null
            kms_key_id                     = null
            post_authentication            = null
            post_confirmation              = null
            pre_authentication             = null
            pre_sign_up                    = "arn:aws:lambda:us-west-2:035866691871:function:mergeUsers"
            pre_token_generation           = null
            user_migration                 = null
            verify_auth_challenge_response = null
        }

        password_policy {
            minimum_length                   = 8
            password_history_size            = 0
            require_lowercase                = true
            require_numbers                  = true
            require_symbols                  = true
            require_uppercase                = true
            temporary_password_validity_days = 7
        }

        schema {
            attribute_data_type      = "String"
            developer_only_attribute = false
            mutable                  = true
            name                     = "email"
            required                 = true

            string_attribute_constraints {
                max_length = "2048"
                min_length = "0"
            }
        }

        sign_in_policy {
            allowed_first_auth_factors = [
                "PASSWORD",
            ]
        }

        sms_configuration {
            external_id    = "************************************"
            sns_caller_arn = "arn:aws:iam::035866691871:role/service-role/homeuniteus-cognito-idp"
            sns_region     = "us-west-2"
        }

        user_attribute_update_settings {
            attributes_require_verification_before_update = [
                "email",
            ]
        }

        username_configuration {
            case_sensitive = false
        }

        verification_message_template {
            default_email_option  = "CONFIRM_WITH_CODE"
            email_message         = null
            email_message_by_link = null
            email_subject         = null
            email_subject_by_link = null
            sms_message           = null
        }
    }

  # module.home-unite-us.aws_cognito_user_pool_client.homeuniteus_prod will be imported
    resource "aws_cognito_user_pool_client" "homeuniteus_prod" {
        access_token_validity                         = 30
        allowed_oauth_flows                           = [
            "code",
        ]
        allowed_oauth_flows_user_pool_client          = true
        allowed_oauth_scopes                          = [
            "aws.cognito.signin.user.admin",
            "email",
            "openid",
            "phone",
            "profile",
        ]
        auth_session_validity                         = 3
        callback_urls                                 = [
            "http://localhost:4040/signin",
            "http://localhost:4040/signup",
            "http://localhost:4040/signup/coordinator",
            "http://localhost:4040/signup/host",
            "https://dev.homeunite.us/signin",
            "https://dev.homeunite.us/signup",
            "https://dev.homeunite.us/signup/coordinator",
            "https://dev.homeunite.us/signup/host",
            "https://qa.homeunite.us/signin",
            "https://qa.homeunite.us/signup",
            "https://qa.homeunite.us/signup/coordinator",
            "https://qa.homeunite.us/signup/host",
        ]
        client_secret                                 = (sensitive value)
        default_redirect_uri                          = null
        enable_propagate_additional_user_context_data = false
        enable_token_revocation                       = true
        explicit_auth_flows                           = [
            "ALLOW_ADMIN_USER_PASSWORD_AUTH",
            "ALLOW_CUSTOM_AUTH",
            "ALLOW_REFRESH_TOKEN_AUTH",
            "ALLOW_USER_PASSWORD_AUTH",
            "ALLOW_USER_SRP_AUTH",
        ]
        id                                            = "b76g3q852lb4us1rbo19he3uj"
        id_token_validity                             = 60
        logout_urls                                   = []
        name                                          = "homeuniteus"
        prevent_user_existence_errors                 = "ENABLED"
        read_attributes                               = [
            "address",
            "birthdate",
            "email",
            "email_verified",
            "family_name",
            "gender",
            "given_name",
            "locale",
            "middle_name",
            "name",
            "nickname",
            "phone_number",
            "phone_number_verified",
            "picture",
            "preferred_username",
            "profile",
            "updated_at",
            "website",
            "zoneinfo",
        ]
        refresh_token_validity                        = 30
        region                                        = "us-west-2"
        supported_identity_providers                  = [
            "COGNITO",
            "Google",
        ]
        user_pool_id                                  = "*******************"
        write_attributes                              = [
            "address",
            "birthdate",
            "email",
            "family_name",
            "gender",
            "given_name",
            "locale",
            "middle_name",
            "name",
            "nickname",
            "phone_number",
            "picture",
            "preferred_username",
            "profile",
            "updated_at",
            "website",
            "zoneinfo",
        ]

        token_validity_units {
            access_token  = "*******"
            id_token      = "*******"
            refresh_token = "****"
        }
    }

  # module.home-unite-us.aws_cognito_user_pool_domain.homeuniteus_prod will be imported
    resource "aws_cognito_user_pool_domain" "homeuniteus_prod" {
        aws_account_id                  = "************"
        certificate_arn                 = null
        cloudfront_distribution         = "dpp0gtxikpq3y.cloudfront.net"
        cloudfront_distribution_arn     = "dpp0gtxikpq3y.cloudfront.net"
        cloudfront_distribution_zone_id = "**************"
        domain                          = "homeuniteus"
        id                              = "homeuniteus"
        managed_login_version           = 1
        region                          = "us-west-2"
        s3_bucket                       = "aws-cognito-prod-pdx-assets"
        user_pool_id                    = "*******************"
        version                         = "20241010065051"
    }

  # module.home-unite-us.aws_iam_role.cognito_idp_prod will be updated in-place
  # (imported from "homeuniteus-cognito-idp")
!~  resource "aws_iam_role" "cognito_idp_prod" {
        arn                   = "arn:aws:iam::035866691871:role/service-role/homeuniteus-cognito-idp"
        assume_role_policy    = jsonencode(
            {
                Statement = [
                    {
                        Action    = "sts:AssumeRole"
                        Condition = {
                            StringEquals = {
                                "sts:ExternalId" = "f027bce1-d945-40d4-8b59-54e12015cdb7"
                            }
                        }
                        Effect    = "Allow"
                        Principal = {
                            Service = "cognito-idp.amazonaws.com"
                        }
                        Sid       = ""
                    },
                ]
                Version   = "2012-10-17"
            }
        )
        create_date           = "2024-10-08T09:25:55Z"
        description           = null
        force_detach_policies = false
        id                    = "homeuniteus-cognito-idp"
        managed_policy_arns   = []
        max_session_duration  = 3600
        name                  = "homeuniteus-cognito-idp"
        name_prefix           = null
        path                  = "/service-role/"
        permissions_boundary  = null
        tags                  = {}
!~      tags_all              = {
+           "managed-by" = "terraform-incubator"
        }
        unique_id             = "*********************"

        inline_policy {
            name   = "homeuniteus-cognito-idp"
            policy = jsonencode(
                {
                    Statement = [
                        {
                            Action   = [
                                "sns:publish",
                            ]
                            Effect   = "Allow"
                            Resource = [
                                "*",
                            ]
                        },
                    ]
                    Version   = "2012-10-17"
                }
            )
        }
    }

  # module.home-unite-us.aws_iam_role_policy.cognito_sns_prod will be imported
    resource "aws_iam_role_policy" "cognito_sns_prod" {
        id          = "homeuniteus-cognito-idp:homeuniteus-cognito-idp"
        name        = "homeuniteus-cognito-idp"
        name_prefix = null
        policy      = jsonencode(
            {
                Statement = [
                    {
                        Action   = [
                            "sns:publish",
                        ]
                        Effect   = "Allow"
                        Resource = [
                            "*",
                        ]
                    },
                ]
                Version   = "2012-10-17"
            }
        )
        role        = "homeuniteus-cognito-idp"
    }

  # module.home-unite-us.aws_secretsmanager_secret.cognito_client_prod will be updated in-place
  # (imported from "arn:aws:secretsmanager:us-west-2:035866691871:secret:homeuniteus-cognito-client-EEaiW4")
!~  resource "aws_secretsmanager_secret" "cognito_client_prod" {
        arn                            = "arn:aws:secretsmanager:us-west-2:035866691871:secret:homeuniteus-cognito-client-EEaiW4"
        description                    = null
+       force_overwrite_replica_secret = false
        id                             = "arn:aws:secretsmanager:us-west-2:035866691871:secret:homeuniteus-cognito-client-EEaiW4"
        kms_key_id                     = null
        name                           = "homeuniteus-cognito-client"
        name_prefix                    = null
        policy                         = jsonencode(
            {
                Statement = [
                    {
                        Action    = "secretsmanager:GetSecretValue"
                        Effect    = "Allow"
                        Principal = {
                            AWS = "arn:aws:iam::035866691871:user/tyler.thome"
                        }
                        Resource  = "*"
                        Sid       = "EnableAnotherAWSAccountToReadTheSecret"
                    },
                ]
                Version   = "2012-10-17"
            }
        )
+       recovery_window_in_days        = 30
        region                         = "us-west-2"
        tags                           = {}
!~      tags_all                       = {
+           "managed-by" = "terraform-incubator"
        }
        type                           = null
    }

Plan: 11 to import, 0 to add, 4 to change, 0 to destroy.

✅ Plan applied in Terraform apply (OIDC) #68