Add Cognito to Terraform

[nyarly]

Dependency

• New Incubator terraform structure using HUU as initial #90

Overview

At least in PeopleDepot, there's a hardcoded Cognito user pool which has a machine-generated identifier. This is generally a sign that something should be pulled into Terraform, since there's an agreement between the value in Terraform and where ever it's defined. If Terraform knows about the resource, it can simply use the random machine value, instead of it having to be supplied.

Action Items

• Determine whether the Cognito pool is specific to PeopleDepot, or is shared by incubator projects
• Determine what kind of configuration in terraform-incubator/ source represent it - is it a resource, because Terraform ought to manage it? Or a data because it should know where to get values for it, but it should be properly managed by a human. Assume a resource, unless a good reason is found why it should be managed manually.
• Implement the appropriate configuration either for people-depot or shared-resources, as appropriate.
• Plan and apply the resulting configuration, noting that if a resource is created, it will need to be brought into the Terraform state with terraform state import commands.

Resources/Instructions

https://developer.hashicorp.com/terraform/language/state/import
https://registry.terraform.io/providers/-/aws/latest/docs/resources/cognito_user_pool

[robinglov]

What if any responsibility will ops have for this issue?

[robinglov]

@chelseybeck this is the first issue I referred to at the ops meeting that looks like infrastructure--possibly an ops issue. After taking a closer look, what are your thoughts?

[chelseybeck]

@robinglov this should stay on incubator. anything related to projects that are in incubator should stay here. but, I self-assigned this issue b/c I can work on it.

[chelseybeck]

I discussed this briefly with @fyliu in Slack and it sounds like we can recreate the Cognito resources as People Depot is in testing phase.

This doesn't apply as a shared resource because each project will have its own Cognito resources

[chelseybeck]

This PR adds a module for creating Cognito resources and then creates example resources for People Depot (which can be customized as needed)

#61

[chelseybeck]

The above PR should be good to go, but there is a state conflict when writing the plan. Discuss w/ Judson/Tyler or both

[ExperimentsInHonesty]

We added a dependency. When that is satisfied. This issue will need a rewrite.

Cognito for shared user pool (hfla users)

If PD wants to share their user pool with VRMS, CTJ, and KB that is fine. Once this Cognito module is running and deployed and available for project use, then we can terraform additional app clients that can be used by those PD's stakeholder customers. There is an open pr for this, that cant be merged until the pr for 90 is merged and then we merge 76 into it.

• open pr adding cognito to people depot #76
• dependency blocking pr New Incubator terraform structure using HUU as initial #90

Cognito for unique user pools (external users for each app are different)

We will also need a module for projects that need a unique user pool (e.g., homeuniteus, techworkexperience, youthjusticenav)