[Alexanderamiri]

Why

The classic hosted UI ignores prompt=select_account. Managed login forwards it to Google, so heroes signed in to a personal Google account get the account chooser instead of a dead end (#157). Stacked on #170.

What

internal_managed_login_version default 1 → 2 (aws_cognito_user_pool_domain.internal). The doc table in cognito-google-setup.md is updated to match. The external pool stays on the classic UI.

How verified

• terraform fmt -check -recursive terraform
• The plan must show one in-place update of module.identity.aws_cognito_user_pool_domain.internal (managed_login_version: 1 -> 2), with no pool, domain or client replacement.

Rollout

Merge only after #170 is applied and its reconcile has run. Before merging, check that every internal client has a style (loop in docs/cognito-google-setup.md step 3). On a managed-login domain, a client without a style has no sign-in page. Live today, the only internal client, cupcake-cupcake, already has a style (created manually on 2026-10-24).

After apply:

• Open https://cupcake.javazone.no/ and sign in. Expect the redirect to the IdP (GoogleSAML until the cutover), not a Cognito error page.
• python3 scripts/auth-doctor.py --app-yaml <frosting>/app.yaml
• Users may have to sign in again once (a new Cognito session).

Rollback: set the variable back to 1. This is also an in-place update.

🤖 Generated with Claude Code

Replaces #171, which GitHub closed when its base branch (#170) was deleted on merge.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 1 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.identity.aws_cognito_user_pool_domain.internal will be updated in-place
  ~ resource "aws_cognito_user_pool_domain" "internal" {
        id                              = "javabin-internal"
      ~ managed_login_version           = 1 -> 2
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Plan makes one in-place update to a Cognito user pool domain (javabin-internal), bumping managed_login_version from 1 to 2, with no creates or destroys.

• ✅ [routine] module.identity.aws_cognito_user_pool_domain.internal is updated in-place: managed_login_version changes from 1 to 2. This switches the domain to the newer Cognito managed login experience. No replacement or destruction is planned.
• 💥 [destruction] Plan summary is 0 to add, 1 to change, 0 to destroy. The domain id (javabin-internal) is unchanged, so the domain itself is not recreated and the hosted login URL should stay the same.
• 🔒 [security] No IAM, security group, or public-access changes are present in this plan. The managed login version change alters the login UI for users of the internal user pool, so it is worth a quick check that any custom branding or app client settings still render correctly after apply.
• 💰 [cost] No new billable resources are created. Cognito pricing is based on monthly active users and is not affected by this version change.