alb_cognito_oidc_rule.tf

alb_cognito_oidc_rule.tf

resource "aws_lb_listener_rule" "cognito" {
  listener_arn = aws_alb_listener.kibana-listener-https.arn

  ### ALB in "eu-west-3" region doesn't support "authenticate-cognito" method ###
  # action {
  #   type = "authenticate-cognito"

  #   authenticate_cognito {
  #     scope               = "openid"
  #     user_pool_arn       = var.cognito_user_pool_arn
  #     user_pool_client_id = var.cognito_user_pool_client_id
  #     user_pool_domain    = var.cognito_user_pool_domain
  #   }
  # }

  action {
    type = "authenticate-oidc"

    authenticate_oidc {
      authorization_endpoint = "https://${var.cognito_user_pool_domain}/oauth2/authorize"
      client_id              = var.cognito_user_pool_client_id
      client_secret          = var.cognito_user_pool_client_secret
      issuer                 = "https://cognito-idp.${var.cognito_user_pool_region}.amazonaws.com/${var.cognito_user_pool_id}"
      token_endpoint         = "https://${var.cognito_user_pool_domain}/oauth2/token"
      user_info_endpoint     = "https://${var.cognito_user_pool_domain}/oauth2/userInfo"
    }
  }

  action {
    type             = "forward"
    target_group_arn = aws_alb_target_group.kibana-tg.arn
  }

  condition {
    path_pattern {
      values = ["/*"]
    }
  }
}