Terraform for iOS 26 App Backends on AWS

resource "aws_cognito_user_pool" "ios" {
  name = "ios-users"
  username_attributes      = ["email"]
  auto_verified_attributes = ["email"]
}
 
resource "aws_cognito_identity_provider" "apple" {
  user_pool_id  = aws_cognito_user_pool.ios.id
  provider_name = "SignInWithApple"
  provider_type = "SignInWithApple"
 
  provider_details = {
    client_id        = var.apple_service_id
    team_id          = var.apple_team_id
    key_id           = var.apple_key_id
    private_key      = var.apple_private_key_pem
    authorize_scopes = "email name"
  }
 
  attribute_mapping = {
    email    = "email"
    username = "sub"
  }
}

resource "aws_sns_platform_application" "ios26" {
  name                = "ios26-app"
  platform            = "APNS"
  platform_credential = file(var.apns_p8_path)
  platform_principal  = var.apns_team_id
}

resource "aws_appsync_graphql_api" "ios" {
  name                = "ios-api"
  authentication_type = "AMAZON_COGNITO_USER_POOLS"
 
  user_pool_config {
    user_pool_id   = aws_cognito_user_pool.ios.id
    aws_region     = var.region
    default_action = "ALLOW"
  }
 
  schema = file("${path.module}/schema.graphql")
}

resource "aws_cloudfront_distribution" "ios_assets" {
  enabled = true
  origin {
    domain_name              = aws_s3_bucket.assets.bucket_regional_domain_name
    origin_id                = "assets"
    origin_access_control_id = aws_cloudfront_origin_access_control.assets.id
  }
 
  default_cache_behavior {
    target_origin_id       = "assets"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    cache_policy_id        = data.aws_cloudfront_cache_policy.optimized.id
  }
 
  restrictions { geo_restriction { restriction_type = "none" } }
  viewer_certificate { cloudfront_default_certificate = true }
}