getclientId:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler: index.handler
      Role: !Getatt LambdaESCognitoRole.Arn
      Code:
        ZipFile: !Sub |
          var AWS = require('aws-sdk');
          const cognitoidentityserviceprovider = new AWS.CognitoIdentityServiceProvider();
          var response = require('cfn-response');
          var responseData = {};
          exports.handler = async (event,context) => {
            console.log(JSON.stringify(event,null,2));
            var params = {
              UserPoolId: event.ResourceProperties.UserPoolId
            };
            await cognitoidentityserviceprovider.listUserPoolClients(params,function(err,data) {
              if (err) console.log(err,err.stack); // an error occurred
              else {
                console.log(data); // successful response 
                responseData = {'ClientId': data.UserPoolClients[0].ClientId};
              }
            }).promise();
            response.send(event,context,response.SUCCESS,responseData);
            return;
            }
      Runtime: nodejs8.10 

   CallgetclientId:
     Type: 'Custom::CallgetclientId'
     Version: 1.0
     Properties:
       ServiceToken: !Getatt getclientId.Arn
       UserPoolId: !Ref CognitoUserPool

  IdentityPoolRoleMapping:
    Type: "AWS::Cognito::IdentityPoolRoleAttachment"
    Properties:
      IdentityPoolId: !Ref CognitoIdentityPool
      Roles:
        authenticated: !Getatt AuthenticatedRole.Arn
        unauthenticated: !Getatt UnauthenticatedRole.Arn
      RoleMappings:
        "cognito-identity-provider":
          IdentityProvider: !Join ['',[ !Getatt CognitoUserPool.ProviderName,':',!Getatt CallgetclientId.ClientId ]] #Need to get the ClientID here
          AmbiguousRoleResolution: Deny
          Type: Rules
          RulesConfiguration:
            Rules:
              - Claim: "custom:groups"
                MatchType: "Contains"
                RoleARN: !Getatt AuthenticatedRole.Arn
                Value: "user"
              - Claim: "custom:groups"
                MatchType: "Contains"
                RoleARN: !Getatt AuthenticatedAdminRole.Arn
                Value: "admin"