aws-amplify / aws-amplify/amplify-cli

Provide IdentityPoolID variable to Auth relationships

Open
#10,095 0 comments 1 reaction 0 assignees View on GitHub
auth feature-request ops-auth p4
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### Is this feature request related to a new or existing Amplify category?

auth

### Is this related to another service?

_No response_

### Describe the feature you'd like to request

When one adds an Amplify project's `auth` as a dependency to another resource, the only parameter provided is currently the `UserPoolId`. However, that is often not enough for some use cases.

For example, if I want read from or write to a user's `private` files in a `storage` resource, I need to retrieve that user's `IID` from the identity pool, as their files have the prefix `/private/{userIID}/`. I.e. given an ID Token `idToken` passed in as an `Authorization: Bearer XXXXX` header to the REST API, I often implement the following code in Lambda:
```typescript
const AWS = require("aws-sdk");
const CognitoIdentity = new AWS.CognitoIdentity();

// other code...

const userIID = (
await CognitoIdentity.getId({
IdentityPoolId: process.env.AUTH__IDENTITYPOOLID,
AccountId: process.env.ACCOUNT_ID,
Logins: {
[`cognito-idp.${process.env.REGION}.amazonaws.com/${process.env.AUTH__USERPOOLID}`]:
idToken,
},
}).promise()
).IdentityId;

// other code...

const image = (
await S3.getObject({
Bucket: file.bucket,
Key: `private/${userIID}/${file.key}`,
}).promise()
).Body;

```

However, the environment variable `AUTH__IDENTITYPOOLID` must be manually configured to be the ID of the Identity Pool built by AWS Amplify, instead of being able to be automatically populated like `AUTH__USERPOOLID`. It would be great if `IdentityPoolId` could be automatically provided through the `dependsOn` Amplify relationship!

### Describe the solution you'd like

The `IdentityPoolId` is shown to be an `Output` of the `auth` resource exactly like `UserPoolId`, as seen in the `-cloudformation-template.json` build file of the `auth` resource:

```json
{
"Outputs": {
"IdentityPoolId": {
"Description": "Id for the identity pool",
"Value": {
"Ref": "IdentityPool"
}
}
}
}
```

So it doesn't seem like it'd be to be too great of a task to provide this variable as an environment variable to dependents. I'm not sure how this is done under the hood, but I imagine it'd be much the same process as for `UserPoolId` to expose this variable such that it is available for use in code.

### Describe alternatives you've considered

As mentioned before, I currently set this environment variable myself by just retrieving the `IdentityPoolId` from the AWS Cognito console. This works for me for now, but it's hacky, and I'd much rather Amplify be able to be fully self-contained. :)

### Additional context

_No response_

### Is this something that you'd be interested in working on?

- [ ] 👋 I may be able to implement this feature request

### Would this feature include a breaking change?

- [ ] ⚠️ This feature might incur a breaking change

Contributor guide

Open the contributing guide

Research direction

Read the -cloudformation-template.json Outputs section to confirm IdentityPoolId, then trace how the existing UserPoolId is passed through auth dependsOn relationships. Done means dependent resources automatically receive AUTH__IDENTITYPOOLID alongside the existing user-pool variable.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cli, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.