Amazon Cognito のリフレッシュトークンローテーションが CloudFormation でもサポートされたので設定を追加してみた

AWSTemplateFormatVersion: '2010-09-09'
Description: ---

Resources:
  # Cognito ユーザープール
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: hoge0514userpool
      AutoVerifiedAttributes:
        - email
      UsernameAttributes:
        - email
      Schema:
        - Name: email
          AttributeDataType: String
          Mutable: false
          Required: true
        - Name: name
          AttributeDataType: String
          Mutable: true
          Required: true
      Policies:
        PasswordPolicy:
          MinimumLength: 8
          RequireLowercase: true
          RequireNumbers: true
          RequireSymbols: true
          RequireUppercase: true
      EmailConfiguration:
        EmailSendingAccount: COGNITO_DEFAULT
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: false
      AccountRecoverySetting:
        RecoveryMechanisms:
          - Name: verified_email
            Priority: 1

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref CognitoUserPool
      ClientName: hoge0514userpoolclient1
      GenerateSecret: true
      AllowedOAuthFlows:
        - implicit
        - code
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthScopes:
        - phone
        - email
        - openid
        - profile
      CallbackURLs:
        - https://example.com/callback
      LogoutURLs:
        - https://example.com/logout
      ExplicitAuthFlows:
        - ALLOW_USER_SRP_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
        - ALLOW_USER_PASSWORD_AUTH
      TokenValidityUnits:
        IdToken: minutes
        AccessToken: minutes
        RefreshToken: days
      IdTokenValidity: 60
      AccessTokenValidity: 60
      RefreshTokenValidity: 30
      RefreshTokenRotation: 
        Feature: ENABLED
        RetryGracePeriodSeconds: 30

:

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref CognitoUserPool
      ClientName: hoge0514userpoolclient1
      GenerateSecret: true
      AllowedOAuthFlows:
        - implicit
        - code
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthScopes:
        - phone
        - email
        - openid
        - profile
      CallbackURLs:
        - https://example.com/callback
      LogoutURLs:
        - https://example.com/logout
      ExplicitAuthFlows:
        - ALLOW_USER_SRP_AUTH
        # - ALLOW_REFRESH_TOKEN_AUTH
        - ALLOW_USER_PASSWORD_AUTH
      TokenValidityUnits:
        IdToken: minutes
        AccessToken: minutes
        RefreshToken: days
      IdTokenValidity: 60
      AccessTokenValidity: 60
      RefreshTokenValidity: 30
      RefreshTokenRotation: 
        Feature: ENABLED
        RetryGracePeriodSeconds: 30