[Alexanderamiri]

Why

Before cutting the internal pool over from GoogleSAML to the Google IdP (#172) we need to know whether managed login forwards prompt=select_account from /oauth2/authorize to Google. No client lists Google, so the redirect cannot be probed today.

What

• app-auth-sync: requests owned by team platform (/javabin/apps/platform/...; platform is excluded from registered teams, so only the platform's own Terraform can write there) may set identity_providers to override the pool's IdP list. Each IdP must exist in the pool (else status error, client untouched). The internal pool never allows COGNITO. Any other team's request with the field is invalid.
• identity module: aws_ssm_parameter.idp_probe_auth writes /javabin/apps/platform/idp-probe/auth. app-auth-sync turns it into client platform-idp-probe with a managed-login branding style, like any app client. The client lists var.internal_idp_probe_identity_providers (default ["Google"]). It is created only once the Google IdP exists, and [] removes it.
• The probe can't be used to sign in: it is a public client with no secret, code flow, callback https://localhost/idp-probe, scopes openid email, and allowed group idp-probe-nobody, which does not exist. auth-claims refuses every token, and the domain check applies as well.
• Docs: the probe command is in docs/cognito-google-setup.md step 3, and the override is described in docs/lambda-functions.md.

How verified

• python3 -m unittest discover -s terraform/lambda-src/tests: 219 OK. New tests cover the platform override with a branding style, app clients keeping the pool list, other teams being refused, an IdP missing from the pool, and COGNITO/empty/malformed lists.
• python3 -m unittest discover -s scripts/tests: OK.
• terraform fmt -check -recursive terraform and terraform validate: OK.

Rollout

Merge, then apply. The plan should only create the SSM parameter and update the app-auth-sync Lambda code, with no Cognito pool, domain or client replacement. The Create event, plus the post-apply reconcile, creates the client and its style. Then run the probe from the docs. No app client changes.

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 1 to add, 1 to change, 0 to destroy.

Plan output

aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.identity.aws_ssm_parameter.idp_probe_auth[0] will be created
  + resource "aws_ssm_parameter" "idp_probe_auth" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + description    = "IdP probe client request for app-auth-sync (platform-owned)"
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/javabin/apps/platform/idp-probe/auth"
      + tags_all       = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/platform"
          + "service"     = "platform"
          + "team"        = "platform"
        }
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + version        = (known after apply)
    }

  # module.lambdas.aws_lambda_function.app_auth_sync will be updated in-place
  ~ resource "aws_lambda_function" "app_auth_sync" {
        id                             = "javabin-app-auth-sync"
      ~ last_modified                  = "2026-10-29T22:04:09.000+0000" -> (known after apply)
      ~ source_code_hash               = "HKStd1VAWlTHRUFr+guun1HqV1RHui7nc1qw1cRONzY=" -> "/APYypBRHgw0Sth8xhiuImapO9oNdBwMtRPosf3/9Rg="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 1 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Plan creates one SSM parameter for a platform-owned IdP probe credential and updates the app-auth-sync Lambda's code in place (source hash change only); nothing is destroyed.

• 🔒 [security] New SSM parameter /javabin/apps/platform/idp-probe/auth is created with a sensitive value, type String (not SecureString). The value is marked sensitive in plan output, but the parameter type should be confirmed: a credential-like value stored as String is readable by anyone with ssm:GetParameter on that path. Consider switching to SecureString with a KMS key.
• 🔒 [security] The parameter holds an IdP probe client request credential that the Lambda may consume. Verify the Lambda's IAM role is scoped to read only this path and that no broader ssm:GetParameter wildcard was granted; IAM changes are not shown in this plan, so this is a check, not a confirmed issue.
• ✅ [routine] Lambda javabin-app-auth-sync is updated in place: only source_code_hash changes (new deployment package). No configuration, role, or networking changes are shown. Standard deploy-time change.
• 💰 [cost] One standard SSM parameter (no meaningful cost) and an in-place Lambda code update. No new billable resources such as NAT gateways, load balancers, or databases.
• 💥 [destruction] 0 resources destroyed. The Lambda is updated in place, not replaced.