title: Terraform Definition of Cognito Identity Pool Auth/Unauth Roles
body: <p>I've been trying to create a terraform script for creating a cognito user pool and identity pool with a linked auth and unauth role, but I can't find a good example of doing this.   Here is what I have so far:</p>
  
  <p>cognito.tf:</p>
  
  <pre><code>resource "aws_cognito_user_pool" "pool" {
       name = "Sample User Pool"
       admin_create_user_config {
            allow_admin_create_user_only = false
       }
  
       /* More stuff here, not included*/
   }
  
   resource "aws_cognito_user_pool_client" "client" {
        name = "client"
        user_pool_id = "${aws_cognito_user_pool.pool.id}"
  
        generate_secret = true
        explicit_auth_flows = ["ADMIN_NO_SRP_AUTH"]
   }
  
   resource "aws_cognito_identity_pool" "main" {
        identity_pool_name               = "SampleIdentityPool"
        allow_unauthenticated_identities = false
  
        cognito_identity_providers {
             client_id               = "${aws_cognito_user_pool_client.id}"
             provider_name           = ""
             server_side_token_check = true
        }
   }
  </code></pre>
  
  <p>So, I want to tack an auth role and an unauth role to this, but I'm still trying to get my head around how to define and link IAM roles in terraform, but here is what I have so far:</p>
  
  <pre><code> resource "aws_cognito_identity_pool_roles_attachment" "main" {
        identity_pool_id = "${aws_cognito_identity_pool.main.id}"
  
        roles {
             "authenticated"   = &lt;&lt;EOF
             {
                  actions = ["sts:AssumeRoleWithWebIdentity"]
  
                  principals {
                       type        = "Federated"
                       identifiers = ["cognito-identity.amazonaws.com"]
                  }
  
                  condition {
                       test = "StringEquals"
                       variable = "cognito-identity.amazonaws.com:aud"
                       values = ["${aws_cognito_identity_pool.main.id}"]
                  }
  
                  condition {
                       test = "ForAnyValue:StringLike"
                       variable = "cognito-identity.amazonaws.com:amr"
                       values = ["authenticated"]
                  }
             }
             EOF
             "unauthenticated" = &lt;&lt;EOF
             {
                  actions = ["sts:AssumeRoleWithWebIdentity"]
  
                  principals {
                       type        = "Federated"
                       identifiers = ["cognito-identity.amazonaws.com"]
                  }
  
                  condition {
                       test = "StringEquals"
                       variable = "cognito-identity.amazonaws.com:aud"
                       values = ["${aws_cognito_identity_pool.main.id}"]
                  }
             }
        EOF
       }
   }
  </code></pre>
  
  <p>This however, doesn't work.  It creates the pools and client correctly, but doesn't attach anything to auth/unauth roles.  I can't figure out what I'm missing, and I can't find any examples of how to do this correctly other than by using the AWS console.  Any help on working this out correctly in terraform would be much appreciated! </p>