This gist contains code from the file cognito.tf which is part of the blog-photo-location-map repository.

blog-photo-location-map-cognito-02.tf

resource "aws_cognito_user_pool_client" "user_pool_client" {
  name                         = local.cognito_user_pool_client_name
  user_pool_id                 = aws_cognito_user_pool.user_pool.id
  supported_identity_providers = ["COGNITO"]

  # Do not generate a client secret for browser-based apps
  generate_secret = false

  # Allowed OAuth flows and scopes for the hosted UI.
  allowed_oauth_flows_user_pool_client = true
  allowed_oauth_flows                  = ["code"]
  allowed_oauth_scopes                 = ["email", "openid", "profile"]

  callback_urls = [
    "${aws_api_gateway_stage.stage.invoke_url}/fetch-object${local.cognito_callback_url_suffix}" # URL where Cognito should redirect after login
  ]

  logout_urls = [
    "${aws_api_gateway_stage.stage.invoke_url}/fetch-object${local.cognito_logout_url_suffix}" # URL to redirect after logout
  ]

  depends_on = [aws_api_gateway_stage.stage]
}