feat(cognito-identitypool-alpha): add addRoleMappings method

packages/@aws-cdk-testing/framework-integ/test/aws-cognito-identitypool/test/integ.identitypool.js.snapshot/integ-idp.template.json

@@ -575,6 +575,26 @@
        ]
       },
       "Type": "Token"
+     },
+     "googleProvider": {
+      "AmbiguousRoleResolution": "Deny",
+      "Type": "Rules",
+      "IdentityProvider": "accounts.google.com",
+      "RulesConfiguration": {
+       "Rules": [
+        {
+         "Claim": "sub",
+         "Value": "someVal",
+         "MatchType": "Equals",
+         "RoleARN": {
+          "Fn::GetAtt": [
+           "identitypoolAuthenticatedRoleB074B49D",
+           "Arn"
+          ]
+         }
+        }
+       ]
+      }
      }
     },
     "Roles": {

packages/@aws-cdk-testing/framework-integ/test/aws-cognito-identitypool/test/integ.identitypool.ts

@@ -2,7 +2,7 @@ import { App, SecretValue, Stack } from 'aws-cdk-lib';
 import { ExpectedResult, IntegTest } from '@aws-cdk/integ-tests-alpha';
 import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
 import { UserPool, UserPoolIdentityProviderGoogle, UserPoolIdentityProviderAmazon, ProviderAttribute, UserPoolClient } from 'aws-cdk-lib/aws-cognito';
-import { IdentityPool, IdentityPoolProviderUrl, UserPoolAuthenticationProvider } from 'aws-cdk-lib/aws-cognito-identitypool';
+import { IdentityPool, IdentityPoolProviderUrl, RoleMappingMatchType, UserPoolAuthenticationProvider } from 'aws-cdk-lib/aws-cognito-identitypool';
 
 const app = new App();
 const stack = new Stack(app, 'integ-idp');
@@ -63,6 +63,18 @@ const idPool = new IdentityPool(stack, 'identitypool', {
   allowClassicFlow: true,
   identityPoolName: 'my-id-pool',
 });
+idPool.addRoleMappings({
+  mappingKey: 'googleProvider',
+  providerUrl: IdentityPoolProviderUrl.GOOGLE,
+  rules: [
+    {
+      claim: 'sub',
+      mappedRole: idPool.authenticatedRole,
+      matchType: RoleMappingMatchType.EQUALS,
+      claimValue: 'someVal',
+    },
+  ],
+});
 idPool.authenticatedRole.addToPrincipalPolicy(new PolicyStatement({
   effect: Effect.ALLOW,
   actions: ['dynamodb:*'],

packages/aws-cdk-lib/aws-cognito-identitypool/README.md

@@ -282,6 +282,31 @@ new IdentityPool(this, 'myidentitypool', {
 });
 ```
 
+Role mappings can also be added after the identity pool has been created using the `addRoleMappings` method:
+
+```ts
+import { IdentityPoolProviderUrl, RoleMappingMatchType } from 'aws-cdk-lib/aws-cognito-identitypool';
+
+declare const identityPool: IdentityPool;
+declare const myRole: iam.Role;
+
+identityPool.addRoleMappings(
+  {
+    mappingKey: 'customProvider',
+    providerUrl: IdentityPoolProviderUrl.custom('custom.example.com'),
+    rules: [
+      {
+        claim: 'myClaim',
+        mappedRole: myRole,
+        matchType: RoleMappingMatchType.EQUALS,
+        claimValue: 'myValue',
+      },
+    ],
+  }
+);
+```
+
+
 #### Provider Urls
 
 Role mappings must be associated with the url of an Identity Provider which can be supplied

packages/aws-cdk-lib/aws-cognito-identitypool/lib/identitypool.ts

@@ -514,6 +514,13 @@ export class IdentityPool extends Resource implements IIdentityPool {
     this.cognitoIdentityProviders = this.cognitoIdentityProviders.concat(providers);
   }
 
+  /**
+   * Add Role Mappings to the Identity Pool
+   */
+  public addRoleMappings(...roleMappings: IdentityPoolRoleMapping[]): void {
+    this.roleAttachment.addRoleMappings(...roleMappings);
+  }
+
   /**
    * Configure default Roles for Identity Pool
    */
@@ -589,28 +596,85 @@ class IdentityPoolRoleAttachment extends Resource implements IIdentityPoolRoleAt
    */
   public readonly identityPoolId: string;
 
+  /**
+   * The Role Attachment L1 resource
+   */
+  private resource: CfnIdentityPoolRoleAttachment;
+
+  /**
+   * The role mappings of the role attachment
+   */
+  private roleMappings?: { [name:string]: CfnIdentityPoolRoleAttachment.RoleMappingProperty };
+
   constructor(scope: Construct, id: string, props: IdentityPoolRoleAttachmentProps) {
     super(scope, id);
     // Enhanced CDK Analytics Telemetry
     addConstructMetadata(this, props);
     this.identityPoolId = props.identityPool.identityPoolId;
     const mappings = props.roleMappings || [];
-    let roles: any = undefined, roleMappings: any = undefined;
+    let roles: any = undefined;
     if (props.authenticatedRole || props.unauthenticatedRole) {
       roles = {};
       if (props.authenticatedRole) roles.authenticated = props.authenticatedRole.roleArn;
       if (props.unauthenticatedRole) roles.unauthenticated = props.unauthenticatedRole.roleArn;
     }
+
     if (mappings) {
-      roleMappings = this.configureRoleMappings(...mappings);
+      this.roleMappings = this.configureRoleMappings(...mappings);
+    } else {
+      this.roleMappings = undefined;
     }
-    new CfnIdentityPoolRoleAttachment(this, 'Resource', {
+
+    this.resource = new CfnIdentityPoolRoleAttachment(this, 'Resource', {
       identityPoolId: this.identityPoolId,
       roles,
-      roleMappings,
+      roleMappings: this.roleMappings,
     });
   }
 
+  /**
+   * Add Role Mappings to the Identity Pool
+   */
+  public addRoleMappings(...roleMappings: IdentityPoolRoleMapping[]) {
+    if (!roleMappings || !roleMappings.length) return;
+    this.roleMappings = {
+      ...this.roleMappings,
+      ...this.configureRoleMappings(...roleMappings),
+    };
+
+    // Convert keys to PascalCase for CloudFormation
+    const toPascalCase = (obj: any): any => {
+      if (Array.isArray(obj)) {
+        return obj.map(item => toPascalCase(item));
+      }
+      if (obj && typeof obj === 'object' && !Token.isUnresolved(obj)) {
+        return Object.entries(obj).reduce((acc, [key, value]) => {
+          // Only these specific keys should be converted to PascalCase
+          const keysToModify = new Set([
+            'ambiguousRoleResolution',
+            'type',
+            'rulesConfiguration',
+            'rules',
+            'matchType',
+            'identityProvider',
+            'claim',
+            'value',
+          ]);
+          const pascalKey = key === 'roleArn' ? 'RoleARN'
+            : keysToModify.has(key) ? key.charAt(0).toUpperCase() + key.slice(1)
+              : key;
+
+          acc[pascalKey] = toPascalCase(value);
+          return acc;
+        }, {} as any);
+      }
+      return obj;
+    };
+
+    const cfnMappings = toPascalCase(this.roleMappings);
+    this.resource.addPropertyOverride('RoleMappings', cfnMappings);
+  }
+
   /**
    * Configures role mappings for the Identity Pool Role Attachment
    */