How to programmatically add SageMaker workforce's URL in Cognito user pool's invitation e-mail?

Question

I want to write Terraform code where I set e-mail body in a Cognito user pool which users get when invited to work on a labeling project in GroundTruth. I need to add URL which the users will go to to log in, update temp password etc. Something like this:
![Enter image description here](/media/postImages/original/IMnpfADda1SLaXv5LmbmbMQg)
where the prefix to the URL is dynamic and known only after creation of SageMaker Workforce.

Basically I have a cycle dependency if I want to set it in a most obvious way, as SageMaker Workforce requires Cognito parameters (https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sagemaker_workforce) and I'd introduce a reference to workforce's URL in the e-mail subject definition.

Cognito does not offer placeholder for the URL, only username and password (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-user-invitation-message-customization.html).

It looks like AWS SageMaker does certain set up under the hood for this case. More specifically the callback URLs set up as described in https://stackoverflow.com/questions/69662004/sagemaker-workforce-with-cognito, as it's mandatory in order for the Cognito login to work properly.

I've tried doing it manually through AWS Console and the option to create a new Cognito user pool, offered on the workforce creation, worked. But I need to do it via Terraform.

Any ideas how to do this, apart from manual update in the AWS console?

Answer

Hello Petar,

You can consider to using a [Lambda CustomMessage trigger](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-custom-message.html#aws-lambda-triggers-custom-message-admin-example) to break the loop.

By using a CustomMessage Lambda trigger, the message content can reference external data, for example [environment variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-retrieve). Once the SageMaker WorkForce resource is provisioned, you can [update the Lambda environment variable](https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html) to the URL.

Please note that this is a high level overview on how you can achieve this programmatically. However, since Terraform is a third party product, I do not have detailed steps on how to achieve the same in Terraform.

How to programmatically add SageMaker workforce's URL in Cognito user pool's invitation e-mail?

Relevant content