Cognito: Identity providers and OAuth flows are enabled by default

❓ General Issue

Recently issue #8134 made OAuth flows be enabled by default event if your user pool had not defined identity providers before.

The Question

Is it reasonable to enable those flows by default since for example here it’s suggested that identity providers that support OAuth flows need to be enabled manually?

In my use case we have no need for these features and don’t want them to be enabled by default. Unfortunately disabling them is not as straightforward as you need to do something like this:

const userPoolClient = new UserPoolClient(this, 'UserPoolClient', {
    ...
    oAuth: {
        flows: {
            implicitCodeGrant: false,
            authorizationCodeGrant: false
        },
        scopes: []
    },
    supportedIdentityProviders: []
};

const cfnUserPoolClient = userPoolClient.node.defaultChild as CfnUserPoolClient;
cfnUserPoolClient.allowedOAuthFlowsUserPoolClient = undefined;

This is quite involved and the worst thing is that you actually need to interact with low-level cfn API to be able to disable everything.

Environment

• CDK CLI Version: 1.43.0
• Module Version: 1.43.0

Other information

I do recognize that this breaking change was detailed in recent release notes. I’m just wondering if these defaults are reasonable since they seem to enable quite powerful features not everyone wants to use. Or have I misunderstood something about the implications of this change?

[nija-at]

A fix for this is in PR https://github.com/aws/aws-cdk/pull/8496

[chalupaa]

In order to not have the oauth settings enabled properly I had to specify all of the following:

            if not oauth_settings:
                client.node.default_child.allowed_o_auth_flows_user_pool_client = False
                client.node.default_child.allowed_o_auth_flows = None
                client.node.default_child.allowed_o_auth_scopes = None