[Alexanderamiri]

Why

The classic hosted UI ignores prompt=select_account. Managed login forwards it to Google, so heroes signed in to a personal Google account get the account chooser instead of a dead end (#157). Stacked on #170.

What

internal_managed_login_version default 1 → 2 (aws_cognito_user_pool_domain.internal). The doc table in cognito-google-setup.md is updated to match. The external pool stays on the classic UI.

How verified

• terraform fmt -check -recursive terraform
• The plan must show one in-place update of module.identity.aws_cognito_user_pool_domain.internal (managed_login_version: 1 -> 2), with no pool, domain or client replacement.

Rollout

Merge only after #170 is applied and its reconcile has run. Before merging, check that every internal client has a style (loop in docs/cognito-google-setup.md step 3). On a managed-login domain, a client without a style has no sign-in page. Live today, the only internal client, cupcake-cupcake, already has a style (created manually on 2026-10-24).

After apply:

• Open https://cupcake.javazone.no/ and sign in. Expect the redirect to the IdP (GoogleSAML until the cutover), not a Cognito error page.
• python3 scripts/auth-doctor.py --app-yaml <frosting>/app.yaml
• Users may have to sign in again once (a new Cognito session).

Rollback: set the variable back to 1. This is also an in-place update.

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 3 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.identity.aws_cognito_user_pool_domain.internal will be updated in-place
  ~ resource "aws_cognito_user_pool_domain" "internal" {
        id                              = "javabin-internal"
      ~ managed_login_version           = 1 -> 2
        # (8 unchanged attributes hidden)
    }

  # module.lambdas.aws_iam_role_policy.app_auth_sync will be updated in-place
  ~ resource "aws_iam_role_policy" "app_auth_sync" {
        id     = "javabin-app-auth-sync:javabin-app-auth-sync"
        name   = "javabin-app-auth-sync"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action   = [
                            "cognito-idp:CreateUserPoolClient",
                            "cognito-idp:UpdateUserPoolClient",
                            "cognito-idp:DeleteUserPoolClient",
                            "cognito-idp:DescribeUserPoolClient",
                            "cognito-idp:ListUserPoolClients",
                            "cognito-idp:ListIdentityProviders",
                        ]
                        Effect   = "Allow"
                        Resource = [
                            "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_Icikv3dtD",
                            "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_gdFOsE4EM",
                        ]
                        Sid      = "ManageAppClients"
                    },
                  + {
                      + Action   = [
                          + "cognito-idp:CreateManagedLoginBranding",
                          + "cognito-idp:DescribeManagedLoginBrandingByClient",
                          + "cognito-idp:DeleteManagedLoginBranding",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_Icikv3dtD",
                          + "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_gdFOsE4EM",
                        ]
                      + Sid      = "ManageAppClientBranding"
                    },
                    {
                        Action   = "cognito-idp:ListUserPools"
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "FindPools"
                    },
                    # (3 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # module.lambdas.aws_lambda_function.app_auth_sync will be updated in-place
  ~ resource "aws_lambda_function" "app_auth_sync" {
        id                             = "javabin-app-auth-sync"
      ~ last_modified                  = "2026-10-26T14:01:56.000+0000" -> (known after apply)
      ~ source_code_hash               = "GvhzSxolQGY8f4/fMAxElLFmKIXk8607SS3v89Em3x4=" -> "HKStd1VAWlTHRUFr+guun1HqV1RHui7nc1qw1cRONzY="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Plan updates 3 existing resources in place (0 add, 0 destroy): a Cognito user pool domain managed-login version bump, an IAM inline policy gaining managed-login branding permissions for the app-auth-sync Lambda, and the Lambda's code hash change.

• 💥 [destruction] No resources are created or destroyed; all three changes are in-place updates. Nothing is replaced, so no data loss or downtime from recreation is expected.
• 🔒 [security] The IAM inline policy 'javabin-app-auth-sync' adds a new statement 'ManageAppClientBranding' with Effect = Allow, granting cognito-idp:CreateManagedLoginBranding, DescribeManagedLoginBrandingByClient and DeleteManagedLoginBranding, scoped to the two Cognito user pools (Icikv3dtD and gdFOsE4EM). This is a new Allow grant, not a Deny, and it is scoped to specific pools rather than '*'. Worth a quick confirm that the Lambda needs branding control, but it is not a dangerous change.
• 🔒 [security] The Cognito user pool domain 'javabin-internal' moves managed_login_version from 1 to 2. This switches the hosted login experience to the newer managed login. It is an in-place change and does not alter access rules, callback URLs or app client settings, but it changes what users see at login.
• ✅ [routine] The Lambda 'javabin-app-auth-sync' gets a new source_code_hash, meaning a new deployment package. Its configuration is otherwise unchanged. This is a routine code update.
• 💰 [cost] No new billable resources (no NAT gateways, RDS, load balancers or similar). Cost impact is negligible.