Security Finding: Disallow user creation on val/prod (#2758)

* try to disable admin create user in prod/val * test in this branch
Enterprise-CMCS · Sep 23, 2024 · b5ae0bd · b5ae0bd
1 parent 88becab
commit b5ae0bd
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/services/ui-auth/serverless.yml b/services/ui-auth/serverless.yml
@@ -51,11 +51,27 @@ resources:
         - Fn::Equals:
             - ''
             - ${self:custom.sesSourceEmailAddress}
+    IsValOrProd:
+      Fn::Or:
+        - Fn::Equals:
+            - ${sls:stage}
+            - 'val'
+        - Fn::Equals:
+            - ${sls:stage}
+            - 'prod'
+        - Fn::Equals:
+            - ${sls:stage}
+            - 'mtsecfindingusers'
   Resources:
     CognitoUserPool:
       Type: AWS::Cognito::UserPool
       Properties:
         UserPoolName: ${sls:stage}-user-pool
+        AdminCreateUserConfig:
+          AllowAdminCreateUserOnly: !If
+            - IsValOrProd
+            - true
+            - false
         UsernameAttributes:
           - email
         AutoVerifiedAttributes: