Migrate from Cognito

user@~: $ mkdir cognito_to_clerk
user@~: $ cd cognito_to_clerk

user@~/cognito_to_clerk: $ npm init -y
user@~/cognito_to_clerk: $ npm i -E @aws-sdk/client-cognito-identity-provider@3.614.0
user@~/cognito_to_clerk: $ npm i -E @clerk/backend@1.4.3

user@~/cognito_to_clerk: $ touch .env
user@~/cognito_to_clerk: $ touch main.ts

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_REGION=

COGNITO_USER_POOL_ID=
COGNITO_CLIENT_ID=

CLERK_SECRET_KEY=

import { createClerkClient } from '@clerk/backend@'
import * as IDP from '@aws-sdk/client-cognito-identity-provider'

// NOTE: The IAM user should have permissions roughly equivalent to AmazonCognitoReadOnly.
// https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonCognitoReadOnly.html
const { AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION } = process.env
if (!AWS_ACCESS_KEY_ID || !AWS_SECRET_ACCESS_KEY || !AWS_REGION) {
  throw new Error(
    'AWS credentials are required. Double check that your `.env` file is set up correctly. Must have AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION.',
  )
}

const { COGNITO_USER_POOL_ID, COGNITO_CLIENT_ID } = process.env
if (!COGNITO_USER_POOL_ID || !COGNITO_CLIENT_ID) {
  throw new Error(
    'Cognito user pool and client IDs are required. Double check that your `.env` file is set up correctly. Must have COGNITO_USER_POOL_ID and COGNITO_CLIENT_ID.',
  )
}

const { CLERK_SECRET_KEY } = process.env
if (!CLERK_SECRET_KEY) {
  throw new Error(
    'Clerk Secret Key is required. Double check that your `.env` file is set up correctly. Must have CLERK_SECRET_KEY.',
  )
}

const idpClient = new IDP.CognitoIdentityProviderClient({
  region: AWS_REGION,
  credentials: {
    accessKeyId: AWS_ACCESS_KEY_ID,
    secretAccessKey: AWS_SECRET_ACCESS_KEY,
  },
})

const clerk = createClerkClient({
  secretKey: CLERK_SECRET_KEY,
})

async function main() {
  const usersResponse = await idpClient.send(
    new IDP.ListUsersCommand({ UserPoolId: COGNITO_USER_POOL_ID }),
  )
  if (!usersResponse.Users) {
    throw new Error('No users found')
  }

  usersLoop: for (const cognitoUser of usersResponse.Users) {
    // Skip unconfirmed users or EXTERNAL_PROVIDER users (like Facebook, Google, etc)
    if (cognitoUser.UserStatus !== 'CONFIRMED') {
      console.log(
        'Skipping user: User is not confirmed:',
        cognitoUser.Username,
        cognitoUser.UserStatus,
      )
      continue
    }

    // This identifier must match the one that use used for sign in on the Cognito user pool.
    // Note that in AWS, this option is only configurable at the time of user creation.
    let identifier: string
    // Comment/Uncomment the block(s) below to use the identifier from the Cognito user pool.
    {
      identifier = cognitoUser.Attributes?.find((a) => a.Name === 'sub')!.Value!
    }
    {
      identifier = cognitoUser.Attributes?.find((a) => a.Name === 'email')!.Value!
    }
    {
      identifier = cognitoUser.Username!
    }

    if (!identifier) {
      console.log('Skipping user: No identifier found:', cognitoUser)
      continue
    }

    const email = cognitoUser.Attributes?.find((a) => a.Name === 'email')!.Value!

    try {
      await clerk.users.createUser({
        emailAddress: [email],
        passwordDigest: `awscognito#${COGNITO_USER_POOL_ID}#${COGNITO_CLIENT_ID}#${identifier}`,
        // @ts-expect-error - awscognito works, but is not a valid TypeScript yet
        passwordHasher: 'awscognito',
      })
      console.log('Created clerk user for:', identifier)
      await new Promise((resolve) => setTimeout(resolve, 500))
    } catch (err) {
      console.error(err)
      break usersLoop
    }
  }
}

main()

user@~/cognito_to_clerk: $ npx tsx --env-file=.env main.ts