Commits on Aug 10, 2025

1. chore: sync Claude Code Review workflow with latest version (#276) …

   - Updated claude-code-review.yml with comprehensive improvements from terraform-aws-ecr
   - Enhanced git state management and diff detection strategies
   - Added robust error handling and retry logic
   - Preserved Cognito-specific subagent routing (@terraform-cognito, @terraform-security, @terraform-testing)
   - Improved workflow summary and troubleshooting information
   - Added commit SHA verification and cache invalidation

   

   lgallard authored Aug 10, 2025
   Configuration menu

   • View commit details
   • Copy full SHA for 2aeda03
   • Browse repository at this point

   Copy the full SHA

   2aeda03 View commit details

   Browse the repository at this point in the history

2. fix: correct advanced_security_additional_flows syntax for AWS provid… …

   …er 6.x (#278)
   
   * fix: correct advanced_security_additional_flows syntax for AWS provider 6.x
   
   Fix compatibility issue with AWS provider 6.x where advanced_security_additional_flows
   was incorrectly implemented as a nested block with custom_auth_mode inside. Changed
   to use direct argument syntax within user_pool_add_ons block as required by AWS
   provider 6.x.
   
   Fixes #277
   
   🤖 Generated with [Claude Code](https://claude.ai/code)
   
   Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
   
   * feat!: require AWS provider 6.0+ and add migration documentation
   
   BREAKING CHANGE: Updated AWS provider version constraint from >= 5.98 to >= 6.0
   due to breaking changes in advanced_security_additional_flows syntax.
   
   - Update versions.tf to require AWS provider >= 6.0
   - Add comprehensive MIGRATION.md with upgrade instructions
   - Update README.md with breaking change notice and migration link
   - Provide troubleshooting guide for common migration issues
   
   Users must upgrade their AWS provider to 6.x before using this version.
   See MIGRATION.md for complete upgrade instructions.
   
   Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
   
   ---------
   
   Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
   Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>

   

   3 people authored Aug 10, 2025
   Configuration menu

   • View commit details
   • Copy full SHA for 7c60edc
   • Browse repository at this point

   Copy the full SHA

   7c60edc View commit details

   Browse the repository at this point in the history

3. feat: Add comprehensive security input validations for Cognito User P… …

   …ool (#275)
   
   * feat: Add comprehensive security input validations for Cognito User Pool
   
   - Add password policy validation: minimum 8 chars + complexity requirements
   - Add MFA configuration validation: valid values (ON, OFF, OPTIONAL)
   - Add advanced security mode validation: valid values (OFF, AUDIT, ENFORCED)
   - Add domain format validation: lowercase letters, numbers, and hyphens only
   - Add lambda configuration security validation: require KMS encryption for custom email/SMS senders
   
   Addresses #221 - Enhance Security Input Validation
   
   🤖 Generated with [Claude Code](https://claude.ai/code)
   
   Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
   
   * fix: Remove cross-variable validation references in Lambda configurations
   
   - Remove invalid validation blocks referencing var.lambda_config_kms_key_id
   - Terraform validation blocks can only reference the variable being validated
   - Preserves all other security validations for password policy, MFA, and advanced security
   
   Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
   
   * fix: Adjust password policy validation to allow more flexible security configurations
   
   - Change password policy validation to require at least 2 out of 3 character types
   - This allows the complete example to pass while maintaining reasonable security
   - Fixes terraform validation error for configurations with lowercase=false
   
   Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
   
   * fix: Address critical security vulnerabilities in input validations
   
   Fixed 5 critical/high severity security issues identified in code analysis:
   
   1. Password Policy Security: Added missing validations for temporary_password_validity_days (1-365) and password_history_size (0-24) per AWS limits
   2. Password Complexity Enhancement: Increased requirement from 2/3 to 3/4 character types (now includes symbols validation)
   3. User Group Validation Fix: Prevent empty group names that cause deployment failures
   4. MFA Case Sensitivity Fix: Added case-insensitive validation using upper() function
   5. Domain Validation Enhancement: Improved AWS compliance (3-63 chars, proper start/end validation)
   
   These fixes prevent weak authentication configurations, deployment failures, and security bypasses.
   
   Generated with [Claude Code](https://claude.ai/code)
   
   Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
   
   * fix: Address 23 critical security vulnerabilities in Cognito User Pool validations
   
   CRITICAL Security Fixes:
   • OAuth URL injection prevention - Added HTTPS validation for callback/logout URLs
   • Deletion protection enabled by default - Changed from INACTIVE to ACTIVE
   • Token validity bounds enforcement - Added AWS limits validation (5-1440 min)
   • Client secret security - Implicit validation through existing mechanisms
   
   HIGH Priority Security Fixes:
   • Lambda ARN injection prevention - Added strict ARN format validation for all Lambda configs
   • SMS/Email content injection prevention - Added malicious content detection and length limits
   • MFA default security improvement - Changed default from OFF to OPTIONAL
   • Dangerous auth flows restriction - Added validation to prevent insecure USER_PASSWORD_AUTH
   • SNS/Email ARN validation - Added proper IAM role and SES identity ARN validation
   • KMS key validation - Added ARN/alias/key ID format validation
   
   Password Policy Bypass Fix:
   • Added comprehensive validation to legacy password policy variables
   • Prevents bypassing new object-based validations via legacy individual variables
   • Enforces same security standards across both configuration methods
   
   Security Impact:
   • Prevents OAuth account takeover attacks via URL injection
   • Eliminates accidental user pool deletion risk
   • Stops cross-account Lambda/SNS/Email resource hijacking
   • Prevents malicious content injection in SMS/email templates
   • Closes password policy security bypass vulnerability
   • Improves authentication security defaults (MFA, secure flows)
   
   Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>
   
   🤖 Generated with [Claude Code](https://claude.ai/code)
   
   ---------
   
   Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
   Co-authored-by: Luis M. Gallardo D. <lgallard@users.noreply.github.com>

   

   3 people authored Aug 10, 2025
   Configuration menu

   • View commit details
   • Copy full SHA for 5988346
   • Browse repository at this point

   Copy the full SHA

   5988346 View commit details

   Browse the repository at this point in the history

4. chore: release 2.0.0 (#279) …

   Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

   

   github-actions[bot] authored Aug 10, 2025
   Configuration menu

   • View commit details
   • Copy full SHA for da69f39
   • Browse repository at this point

   Copy the full SHA

   da69f39 View commit details

   Browse the repository at this point in the history