[Alexanderamiri]

Why

Part of #157. The internal pool (javabin-internal, eu-central-1_Icikv3dtD) is open to the internet today:

• AllowAdminCreateUserOnly is false, so self sign-up is on.
• app-auth-sync puts COGNITO on every client, so the hosted UI shows a sign-up link.

Together, anyone can create a user in the internal pool with their own Gmail address. An app with auth: internal and no groups accepts that user. Nothing checks the email domain on the server side.

The COGNITO entry also puts a password form in front of Google. The frosting client was hand-edited in the console to [GoogleSAML] to remove the form. The 03:30 UTC reconcile undoes that edit.

What

• identity/main.tf

  • The internal pool gets admin_create_user_config { allow_admin_create_user_only = true }.
  • The internal auth-claims function gets two new env vars:
    • REQUIRED_EMAIL_DOMAIN = var.google_workspace_domain (java.no);
    • FEDERATED_IDENTITY_PROVIDERS, set from the internal IdP list.

• New variables internal_identity_providers (default ["GoogleSAML"]) and external_identity_providers (default ["COGNITO"]).

  • They are declared in the identity module, output from it, and passed to app-auth-sync as INTERNAL_IDENTITY_PROVIDERS / EXTERNAL_IDENTITY_PROVIDERS.
  • Validation: the internal list must not include COGNITO and must not be empty.

• app-auth-sync

  • Each client gets exactly its pool's IdP list.
  • If a configured IdP doesn't exist in the pool, the request is skipped: an ERROR log and status: error (reconcile lists it under error). Nothing is created, moved or wiped, and the existing client keeps working.
  • Settings are resolved before the pool-switch cleanup, so a misconfigured target pool can't delete the client in the old pool.

• auth-claims: when REQUIRED_EMAIL_DOMAIN is set, a token is refused unless both of these hold:

  • the email ends with @java.no (case-insensitive);
  • the user is federated through a listed IdP (from the identities attribute, or the <Provider>_ username), or has email_verified=true.

  The user sees "Sign in with your @java.no account." Logs mask the address as e***@java.no.

• Review follow-ups

  • app-auth-sync rejects aws.cognito.signin.user.admin for pool: internal (status invalid, client not created or changed). That scope would let a signed-in user call UpdateUserAttributes and point their email at another @java.no user, whose registry groups auth-claims would then grant. No live request uses it (only cupcake, with openid email profile). The external pool still allows it.
  • New aws_cloudwatch_log_metric_filter + aws_cloudwatch_metric_alarm javabin-app-auth-sync-skipped on client left unchanged in /aws/lambda/javabin-app-auth-sync, posting to javabin-alerts (Slack via slack-alert). The javabin-alerts topic policy gets an AllowCloudWatchAlarmsPublish statement scoped to this account's alarms.
  • internal_identity_providers documents that each entry is trusted to vouch for email, so it must release only Workspace accounts (Google OIDC needs an Internal-consent client, or an email_verified/hd check first).
  • auth-claims masks the email in the group-denial log too.

• Docs: docs/lambda-functions.md (both functions) and the docs/app-yaml-reference.md auth section, which covers no password form or sign-up, the @java.no rule, and how a denial arrives as error_description.

How verified

• Unit tests: python3 -m unittest discover -s terraform/lambda-src/tests (79 OK) and scripts/tests (43 OK). New tests cover:
  • the fixed IdP list, and the reconcile reverting a console edit to the list;
  • env config, the missing-IdP skip on create, update, pool switch and reconcile, and an empty list;
  • for the domain rule: SAML users with email_verified=false, lookalike domains, native users with and without a verified email, other IdPs, and a pool without the rule.
• terraform fmt -check -recursive and terraform validate pass.
• Read-only checks against live state:
  • Users: the pool has 4 users. All are GoogleSAML_…, @java.no, EXTERNAL_PROVIDER, email_verified=false, identities provider GoogleSAML. All 4 pass through the federated-IdP branch. This exact shape is a unit test.
  • Auth requests: there is one, /javabin/apps/cupcake/cupcake/auth (frosting, public client, groups [helter]). After this change its client gets [GoogleSAML], the same as the console edit, so the reconcile no longer reverts it. cupcake-backend is client: none and is unaffected.
  • IdPs: the internal pool has exactly one IdP, GoogleSAML, so the configured list resolves. The external pool keeps ["COGNITO"], which is what it gets today (it has no IdPs).
• Plan expectation:
  • in-place updates: aws_cognito_user_pool.internal (admin_create_user_config is not ForceNew), aws_lambda_function.auth_claims (env) and aws_lambda_function.app_auth_sync (env + code), aws_sns_topic_policy.alerts (new statement);
  • creates: the log metric filter and the alarm (the log group already exists);
  • no destroys, no pool replacement.

Rollout & user actions

• None needed after merge. The CI apply updates the pool and both Lambdas.
• The next auth-request change, or the 03:30 UTC reconcile, sets every internal client to [GoogleSAML]. To apply it right away, run aws lambda invoke --function-name javabin-app-auth-sync --payload '{"action":"reconcile"}' --cli-binary-format raw-in-base64-out /dev/stdout.
• Existing sessions keep working. Refresh tokens pass the domain check because all current users qualify.

Follow-ups

• Interaction with feat(routing): require sign-in on app.yaml paths at the load balancer #158 (feat/alb-login). That PR edits the same functions in app-auth-sync (client_settings, sync, reconcile) and adds auth_claims_external from the same handler. The external function doesn't set REQUIRED_EMAIL_DOMAIN, so it skips the domain check, which is intended.
  • Rebase on top of this PR: client_settings() now takes pool first.
  • service-routing's hardcoded internal_identity_provider = "GoogleSAML" can be dropped once clients have a single IdP. The hosted UI already redirects.
• Overlap with fix(platform): harden ALB, Cognito pools, subnets and bucket TLS #165. It adds deletion_protection = "ACTIVE" to both pools (raised in review here too; left to fix(platform): harden ALB, Cognito pools, subnets and bucket TLS #165 to avoid a duplicate). The change is a different attribute, so expect a trivial text merge at most.
• Not done here: user_attribute_update_settings { attributes_require_verification_before_update = ["email"] } on the internal pool. Blocking the user-admin scope closes the reported path; the pool setting would also affect how SAML attribute mapping updates email, which can't be checked without applying, so it is left for a separate, tested change.
• Internal login fails with Google 403 app_not_configured_for_user when another Google account is active #157 next step: switching to Google OIDC.
  • Set internal_identity_providers = ["Google"] once the IdP exists.
  • Google users then count as federated. That is safe only with an Internal-consent GCP client (java.no accounts only), as the design note proposes. Otherwise, map email_verified and drop Google from the trusted list.
• Bring GoogleSAML under Terraform with an import block, or remove it after cutover.

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 3 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.identity.aws_cognito_user_pool.internal will be updated in-place
  ~ resource "aws_cognito_user_pool" "internal" {
        id                        = "eu-central-1_Icikv3dtD"
        name                      = "javabin-internal"
        tags                      = {
            "Name" = "javabin-internal"
        }
        # (12 unchanged attributes hidden)

      ~ admin_create_user_config {
          ~ allow_admin_create_user_only = false -> true
        }

        # (7 unchanged blocks hidden)
    }

  # module.identity.aws_lambda_function.auth_claims will be updated in-place
  ~ resource "aws_lambda_function" "auth_claims" {
        id                             = "javabin-auth-claims"
      ~ last_modified                  = "2026-10-23T15:36:35.282+0000" -> (known after apply)
      ~ source_code_hash               = "T0XK8BQ05sxP5MVCsIGH+JuY++sBeQohaGTkvMdm81M=" -> "g5gt69/9UeCPElGSkbf6DkPPSFNXH02JSXQGtqm4c/I="
        tags                           = {}
        # (21 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              + "FEDERATED_IDENTITY_PROVIDERS" = "GoogleSAML"
              + "REQUIRED_EMAIL_DOMAIN"        = "java.no"
                # (1 unchanged element hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

  # module.lambdas.aws_lambda_function.app_auth_sync will be updated in-place
  ~ resource "aws_lambda_function" "app_auth_sync" {
        id                             = "javabin-app-auth-sync"
      ~ last_modified                  = "2026-10-23T15:31:34.000+0000" -> (known after apply)
      ~ source_code_hash               = "sIha3Wb5dyMLBep00WQdQ/yhswtf4SXSuDzJX076WoE=" -> "e3Gaxh2v+oXw+ghxdo3QLl6JjAfHNJOB0Tk+RP8GRmc="
        tags                           = {}
        # (21 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              + "EXTERNAL_IDENTITY_PROVIDERS" = "COGNITO"
              + "INTERNAL_IDENTITY_PROVIDERS" = "GoogleSAML"
                # (2 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟡 MEDIUM

Plan updates 3 existing resources in place (0 add, 0 destroy): a Cognito user pool setting change that stops self sign-up, and two Lambda code and environment updates for federated identity provider configuration.

• 🔒 [security] Cognito user pool javabin-internal: admin_create_user_config.allow_admin_create_user_only changes false -> true. This disables self sign-up, so only administrators can create users. This is a tightening change, but it affects who can access the internal pool and should be confirmed as intended alongside the federation changes.
• 🔒 [security] Lambda javabin-auth-claims gains environment variables FEDERATED_IDENTITY_PROVIDERS=GoogleSAML and REQUIRED_EMAIL_DOMAIN=java.no, and its code hash changes. The email domain restriction is a useful access control, but the new code is not visible in the plan, so the logic it runs cannot be reviewed here. Verify the code change in the commit or artifact that produced it.
• ✅ [routine] Lambda javabin-app-auth-sync gains INTERNAL_IDENTITY_PROVIDERS=GoogleSAML and EXTERNAL_IDENTITY_PROVIDERS=COGNITO, plus a new code hash. Environment-only and code updates, with no change to IAM roles, triggers or networking in this plan.
• 💰 [cost] No new billable resources are created. Cost impact is negligible.
• 💥 [destruction] No resources are destroyed or replaced. All three changes are in-place updates, so the Cognito pool keeps its ID and its users.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 2 to add, 4 to change, 0 to destroy.

Plan output

aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.identity.aws_cognito_user_pool.internal will be updated in-place
  ~ resource "aws_cognito_user_pool" "internal" {
        id                        = "eu-central-1_Icikv3dtD"
        name                      = "javabin-internal"
        tags                      = {
            "Name" = "javabin-internal"
        }
        # (12 unchanged attributes hidden)

      ~ admin_create_user_config {
          ~ allow_admin_create_user_only = false -> true
        }

        # (7 unchanged blocks hidden)
    }

  # module.identity.aws_lambda_function.auth_claims will be updated in-place
  ~ resource "aws_lambda_function" "auth_claims" {
        id                             = "javabin-auth-claims"
      ~ last_modified                  = "2026-10-23T15:36:35.282+0000" -> (known after apply)
      ~ source_code_hash               = "T0XK8BQ05sxP5MVCsIGH+JuY++sBeQohaGTkvMdm81M=" -> "7KJRUIQbOY5MEZQ2WTZkRPiF0xtT6GURFhNiTZGZo6o="
        tags                           = {}
        # (21 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              + "FEDERATED_IDENTITY_PROVIDERS" = "GoogleSAML"
              + "REQUIRED_EMAIL_DOMAIN"        = "java.no"
                # (1 unchanged element hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

  # module.lambdas.aws_cloudwatch_log_metric_filter.app_auth_sync_skipped will be created
  + resource "aws_cloudwatch_log_metric_filter" "app_auth_sync_skipped" {
      + id             = (known after apply)
      + log_group_name = "/aws/lambda/javabin-app-auth-sync"
      + name           = "javabin-app-auth-sync-skipped"
      + pattern        = "\"client left unchanged\""

      + metric_transformation {
          + default_value = "0"
          + name          = "AppAuthSyncSkipped"
          + namespace     = "Javabin/AppAuthSync"
          + unit          = "None"
          + value         = "1"
        }
    }

  # module.lambdas.aws_cloudwatch_metric_alarm.app_auth_sync_skipped will be created
  + resource "aws_cloudwatch_metric_alarm" "app_auth_sync_skipped" {
      + actions_enabled                       = true
      + alarm_actions                         = [
          + "arn:aws:sns:eu-central-1:553637109631:javabin-alerts",
        ]
      + alarm_description                     = "app-auth-sync skipped an app.yaml auth request because a configured identity provider is missing from the pool. See /aws/lambda/javabin-app-auth-sync."
      + alarm_name                            = "javabin-app-auth-sync-skipped"
      + arn                                   = (known after apply)
      + comparison_operator                   = "GreaterThanThreshold"
      + evaluate_low_sample_count_percentiles = (known after apply)
      + evaluation_periods                    = 1
      + id                                    = (known after apply)
      + metric_name                           = "AppAuthSyncSkipped"
      + namespace                             = "Javabin/AppAuthSync"
      + period                                = 300
      + statistic                             = "Sum"
      + tags_all                              = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/platform"
          + "service"     = "platform"
          + "team"        = "platform"
        }
      + threshold                             = 0
      + treat_missing_data                    = "notBreaching"
    }

  # module.lambdas.aws_lambda_function.app_auth_sync will be updated in-place
  ~ resource "aws_lambda_function" "app_auth_sync" {
        id                             = "javabin-app-auth-sync"
      ~ last_modified                  = "2026-10-23T15:31:34.000+0000" -> (known after apply)
      ~ source_code_hash               = "sIha3Wb5dyMLBep00WQdQ/yhswtf4SXSuDzJX076WoE=" -> "d1t3s0DwtOCO4J/h0uTpYtHYVnp6f/5eRhipC6lyDvI="
        tags                           = {}
        # (21 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              + "EXTERNAL_IDENTITY_PROVIDERS" = "COGNITO"
              + "INTERNAL_IDENTITY_PROVIDERS" = "GoogleSAML"
                # (2 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

  # module.monitoring.aws_sns_topic_policy.alerts will be updated in-place
  ~ resource "aws_sns_topic_policy" "alerts" {
        id     = "arn:aws:sns:eu-central-1:553637109631:javabin-alerts"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (2 unchanged elements hidden)
                    {
                        Action    = "SNS:Publish"
                        Effect    = "Allow"
                        Principal = {
                            Service = "events.amazonaws.com"
                        }
                        Resource  = "arn:aws:sns:eu-central-1:553637109631:javabin-alerts"
                        Sid       = "AllowEventsPublish"
                    },
                  + {
                      + Action    = "SNS:Publish"
                      + Condition = {
                          + ArnLike      = {
                              + "aws:SourceArn" = "arn:aws:cloudwatch:eu-central-1:553637109631:alarm:*"
                            }
                          + StringEquals = {
                              + "aws:SourceAccount" = "553637109631"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "cloudwatch.amazonaws.com"
                        }
                      + Resource  = "arn:aws:sns:eu-central-1:553637109631:javabin-alerts"
                      + Sid       = "AllowCloudWatchAlarmsPublish"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (2 unchanged attributes hidden)
    }

Plan: 2 to add, 4 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟡 MEDIUM

Plan adds two CloudWatch resources (metric filter and alarm) for app-auth-sync skipped requests and updates the Cognito user pool, two Lambda functions, and an SNS topic policy; nothing is destroyed, but enabling admin-only user creation and the new Lambda environment variables change authentication behaviour and should be confirmed before apply.

• 🔒 [security] Cognito user pool javabin-internal changes allow_admin_create_user_only from false to true, so end users can no longer self-sign-up. This is an intentional-looking hardening but changes how accounts are created and should be confirmed with the identity owners.
• 🔒 [security] auth_claims Lambda gains FEDERATED_IDENTITY_PROVIDERS=GoogleSAML and REQUIRED_EMAIL_DOMAIN=java.no, which restricts which logins are accepted. Verify the domain check and provider name are correct, since a typo could lock out users or weaken the restriction.
• 🔒 [security] SNS topic policy javabin-alerts gains a statement letting cloudwatch.amazonaws.com publish, scoped by aws:SourceArn to alarms in account 553637109631 and aws:SourceAccount. This is a properly constrained grant, not a public one. The existing events.amazonaws.com statement is unchanged.
• ✅ [routine] app_auth_sync and auth_claims Lambda code updates (source_code_hash changes) and new environment variables for internal/external identity provider routing. These are routine code and config updates with no resources replaced.
• ✅ [routine] New metric filter on /aws/lambda/javabin-app-auth-sync matching "client left unchanged", feeding the AppAuthSyncSkipped metric, plus an alarm that fires on any count above 0 and notifies javabin-alerts. This is observability only and has negligible cost.
• 💥 [destruction] Plan has 0 destroys and no resource replacements. All changes are in-place updates or creates.