new data source cognito_user_pool_signing_certificate

.changelog/22285.txt

@@ -0,0 +1,3 @@
+```release-note:new-data-source
+aws_cognito_user_pool_signing_certificate
+```

internal/provider/provider.go

@@ -396,7 +396,8 @@ func Provider() *schema.Provider {
 
 			"aws_codestarconnections_connection": codestarconnections.DataSourceConnection(),
 
-			"aws_cognito_user_pools": cognitoidp.DataSourceUserPools(),
+			"aws_cognito_user_pools":                    cognitoidp.DataSourceUserPools(),
+			"aws_cognito_user_pool_signing_certificate": cognitoidp.DataSourceUserPoolSigningCertificate(),
 
 			"aws_connect_contact_flow": connect.DataSourceContactFlow(),
 			"aws_connect_instance":     connect.DataSourceInstance(),

internal/service/cognitoidp/test-fixtures/saml-metadata.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://terraform-dev-ed.my.salesforce.com" validUntil="2070-08-31T14:30:09Z">
+  <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:KeyDescriptor use="signing">
+      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:X509Data>
+          <ds:X509Certificate>MIICfjCCAeegAwIBAgIBADANBgkqhkiG9w0BAQ0FADBbMQswCQYDVQQGEwJ1czELMAkGA1UECAwCQ0ExEjAQBgNVBAoMCVRlcnJhZm9ybTErMCkGA1UEAwwidGVycmFmb3JtLWRldi1lZC5teS5zYWxlc2ZvcmNlLmNvbTAgFw0yMDA4MjkxNDQ4MzlaGA8yMDcwMDgxNzE0NDgzOVowWzELMAkGA1UEBhMCdXMxCzAJBgNVBAgMAkNBMRIwEAYDVQQKDAlUZXJyYWZvcm0xKzApBgNVBAMMInRlcnJhZm9ybS1kZXYtZWQubXkuc2FsZXNmb3JjZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOxUTzEKdivVjfZ/BERGpX/ZWQsBKHut17dQTKW/3jox1N9EJ3ULj9qEDen6zQ74Ce8hSEkrG7MP9mcP1oEhQZSca5tTAop1GejJG+bfF4v6cXM9pqHlllrYrmXMfESiahqhBhE8VvoGJkvp393TcB1lX+WxO8Q74demTrQn5tgvAgMBAAGjUDBOMB0GA1UdDgQWBBREKZt4Av70WKQE4aLD2tvbSLnBlzAfBgNVHSMEGDAWgBREKZt4Av70WKQE4aLD2tvbSLnBlzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBDQUAA4GBACxeC29WMGqeOlQF4JWwsYwIC82SUaZvMDqjAm9ieIrAZRH6J6Cu40c/rvsUGUjQ9logKX15RAyI7Rn0jBUgopRkNL71HyyM7ug4qN5An05VmKQWIbVfxkNVB2Ipb/ICMc5UE38G4y4VbANZFvbFbkVq6OAP2GGNl22o/XSnhFY8</ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </md:KeyDescriptor>
+    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://terraform-dev-ed.my.salesforce.com/idp/endpoint/HttpPost"/>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://terraform-dev-ed.my.salesforce.com/idp/endpoint/HttpRedirect"/>
+  </md:IDPSSODescriptor>
+</md:EntityDescriptor>

internal/service/cognitoidp/user_pool_signing_certificate_data_source.go

@@ -0,0 +1,47 @@
+package cognitoidp
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-provider-aws/internal/conns"
+)
+
+func DataSourceUserPoolSigningCertificate() *schema.Resource {
+	return &schema.Resource{
+		Read: dataSourceUserPoolSigningCertificateRead,
+
+		Schema: map[string]*schema.Schema{
+			"certificate": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+			"user_pool_id": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+		},
+	}
+}
+
+func dataSourceUserPoolSigningCertificateRead(d *schema.ResourceData, meta interface{}) error {
+	conn := meta.(*conns.AWSClient).CognitoIDPConn
+
+	userPoolID := d.Get("user_pool_id").(string)
+	input := &cognitoidentityprovider.GetSigningCertificateInput{
+		UserPoolId: aws.String(userPoolID),
+	}
+
+	output, err := conn.GetSigningCertificate(input)
+
+	if err != nil {
+		return fmt.Errorf("error reading Cognito User Pool (%s) Signing Certificate: %w", userPoolID, err)
+	}
+
+	d.SetId(userPoolID)
+	d.Set("certificate", output.Certificate)
+
+	return nil
+}

internal/service/cognitoidp/user_pool_signing_certificate_data_source_test.go

@@ -0,0 +1,58 @@
+package cognitoidp_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
+	sdkacctest "github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-aws/internal/acctest"
+)
+
+func TestAccCognitoIDPUserPoolSigningCertificateDataSource_basic(t *testing.T) {
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	datasourceName := "data.aws_cognito_user_pool_signing_certificate.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:   func() { acctest.PreCheck(t); testAccPreCheckIdentityProvider(t) },
+		ErrorCheck: acctest.ErrorCheck(t, cognitoidentityprovider.EndpointsID),
+		Providers:  acctest.Providers,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccUserPoolSigningCertificateDataSourceConfig_basic(rName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrSet(datasourceName, "certificate"),
+				),
+			},
+		},
+	})
+}
+
+func testAccUserPoolSigningCertificateDataSourceConfig_basic(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_cognito_user_pool" "test" {
+  name                     = %[1]q
+  auto_verified_attributes = ["email"]
+}
+
+resource "aws_cognito_identity_provider" "test" {
+  user_pool_id  = aws_cognito_user_pool.test.id
+  provider_name = "SAML"
+  provider_type = "SAML"
+
+  provider_details = {
+    MetadataFile          = file("./test-fixtures/saml-metadata.xml")
+    SSORedirectBindingURI = "https://terraform-dev-ed.my.salesforce.com/idp/endpoint/HttpRedirect"
+  }
+
+  attribute_mapping = {
+    email = "email"
+  }
+}
+
+data "aws_cognito_user_pool_signing_certificate" "test" {
+  user_pool_id = aws_cognito_user_pool.test.id
+}
+`, rName)
+}

website/docs/d/cognito_user_pool_signing_certificate.markdown

@@ -0,0 +1,27 @@
+---
+subcategory: "Cognito"
+layout: "aws"
+page_title: "AWS: aws_cognito_user_pool_signing_certificate"
+description: |-
+  Get signing certificate of user pool
+---
+
+# Data Source: aws_cognito_user_pool_signing_certificate
+
+Use this data source to get the signing certificate for a Cognito IdP user pool.
+
+## Example Usage
+
+```terraform
+data "aws_cognito_user_pool_signing_certificate" "sc" {
+  user_pool_id = aws_cognito_user_pool.my_pool.id
+}
+```
+
+## Argument Reference
+
+* `user_pool_id` - (required) The Cognito user pool ID.
+
+## Attributes Reference
+
+* `certificate` - The certificate string