Pre migration:

1. Get Cogonito user pool configured - to be fully terraformed
   a. password policy: default
   b. lambdas: migrate user trigger & pre token generation trigger
   c. app client for Admins-UI
   d. messaging - FROM email: no-reply@tis.nhs.uk

2. Get Admins API-Gateway configured - terraformed

3. Get Admins-UI on CloudFront configured (pipeline should be done on another branch) - in progress

4. Upgrade Amplify to version 6 for Admins-UI

5. Get revalidation config PR ready and Reval API-Gateway PR ready (ready means approved, or merged and not applied yet) - not yet

6. Get UserManagement fully tested locally (give errors to admins when user does not exist on Cognito?)
   We do give an error when the user does not exist, but the error is thrown from the backend and it is not shown in a friendly way to users.

7. Give notice to all users in advance

...

Parallel branches:

1. Admins-UI: https://github.com/Health-Education-England/TIS-ADMINS-UI/tree/detached/configureAuthWithCognito_DO_NOT_MERGE

2. Reval-UI:

Migration steps:

1. Give notice to users to inform the migration start

2. Restrict access of UserManagement (Modify API-Gateway to only allow some specific get reqeusts? Or remove user permission/roles temporarily? Or remove mapping annotation on the endpoints (POST/DELETE)?)

3. Switch Admins-UI DNS to use the app on CloudFront (new Admins API-Gateway), mind the TTL
   Update the website terraform - to use existing domains/host names. (How do we verify this upfront?)

4. Switch Reval to the new user pool and get Reval API-Gateway configured

5. Switch UserManagement to Cognito and release the UserManagement to users

...