aws-amplify / aws-amplify/amplify-cli
Cannot push new auth on more than one backend environment when using federated auth
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### How did you install the Amplify CLI?
curl
### If applicable, what version of Node.js are you using?
20.10.0
### Amplify CLI Version
12.10.0
### What operating system are you using?
Mac
### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
No manual changes made.
### Describe the bug
I am attempting to add federated auth (Google) to my amplify app, with three backend environments (dev, test, prod).
When I run `amplify add auth` and follow the steps on my dev environment, the `amplify push` works fine and all the resources are correctly created.
Then if I checkout one of the two other environments (ex: `amplify checkout env test`) and attempt to push my backend, it fails and rolls back with the error stack below. Same with the prod environment.
### Expected behavior
Upon pushing in a different backend environment, each environment has its own Cognito user pool. All user pools, one for each environment, have the same configuration and use the same provider web client ID and secret.
### Reproduction steps
1. `mkdir whatever`
2. `cd whatever`
3. `amplify init`
4. `amplify add env test`
5. `amplify checkout env dev`
6. `amplify add auth` (below are my selections)
* Default configuration with Social Provider (Federation)
* Email
* Yes I want to make some additional changes
* Select email, given name, family name, picture
* Next step, do not select any additional capabilities
* Use default prefix
* Sign in URI : http://localhost:3000/
* No additional sign in URI
* Sign out URI : http://localhost:3000/
* No additional sign out URI
* Select only Google in the provider list
* Enter a valid Web Client ID. Mine looks approximately like this: 000000000000-xxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com
* Enter a valid Web Client Secret: : XXXXXX-XXXXXXXXX_XXXXXXXXXXXXX
7. `amplify push`
8. `amplify checkout env test`
9. `amplify status` (note here that auth is to be updated)
10. `amplify push`
### Project Identifier
8ce6a4a3421c34deb27784cf3925bcfb
### Log output
```
Deployment failed.
Deploying root stack dnsauditor [ ====================-------------------- ] 3/6
amplify-dnsauditor-test-191549 AWS::CloudFormation::Stack UPDATE_ROLLBACK_COMPLETE_CLE
apidnsauditor AWS::CloudFormation::Stack UPDATE_COMPLETE
functionaudit AWS::CloudFormation::Stack UPDATE_COMPLETE
authdnsauditorc9fb2a0b AWS::CloudFormation::Stack UPDATE_FAILED
apiaudit AWS::CloudFormation::Stack UPDATE_COMPLETE
Deploying auth dnsauditorc9fb2a0b [ ===------------------------------------- ] 1/14
HostedUIProvidersCustomResour… Custom::LambdaCallout UPDATE_COMPLETE
UserPoolClientWeb AWS::Cognito::UserPoolClient UPDATE_FAILED
UserPoolClient AWS::Cognito::UserPoolClient UPDATE_FAILED
🛑 The following resources failed to deploy:
Resource Name: UserPoolClient (AWS::Cognito::UserPoolClient)
Event Type: update
Reason: Resource handler returned message: "The provider Google does not exist for User Pool ca-central-1_XXXXXXXXXX. (Service: CognitoIdentityProvider, Status Code: 400, Request ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)" (RequestToken: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, HandlerErrorCode: InvalidRequest)
URL: https://console.aws.amazon.com/cloudformation/home?region=ca-central-1#/stacks/arn%3Aaws%3Acloudformation%3Aca-central-1%3A590382766331%3Astack%2Famplify-dnsauditor-test-191549-authdnsauditorc9fb2a0b-UHL0KWC41QBO%2F4cd9d740-a040-11ee-b8ca-0e529d418748/events
Resource Name: UserPoolClientWeb (AWS::Cognito::UserPoolClient)
Event Type: update
Reason: Resource handler returned message: "The provider Google does not exist for User Pool ca-central-1_XXXXXXXXXX. (Service: CognitoIdentityProvider, Status Code: 400, Request ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)" (RequestToken: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, HandlerErrorCode: InvalidRequest)
URL: https://console.aws.amazon.com/cloudformation/home?region=ca-central-1#/stacks/arn%3Aaws%3Acloudformation%3Aca-central-1%3A590382766331%3Astack%2Famplify-dnsauditor-test-191549-authdnsauditorc9fb2a0b-UHL0KWC41QBO%2F4cd9d740-a040-11ee-b8ca-0e529d418748/events
🛑 Resource is not in the state stackUpdateComplete
Name: UserPoolClient (AWS::Cognito::UserPoolClient), Event Type: update, Reason: Resource handler returned message: "The provider Google does not exist for User Pool ca-central-1_XXXXXXXXXX. (Service: CognitoIdentityProvider, Status Code: 400, Request ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)" (RequestToken: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, HandlerErrorCode: InvalidRequest), IsCustomResource: false
Name: UserPoolClientWeb (AWS::Cognito::UserPoolClient), Event Type: update, Reason: Resource handler returned message: "The provider Google does not exist for User Pool ca-central-1_XXXXXXXXXX. (Service: CognitoIdentityProvider, Status Code: 400, Request ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)" (RequestToken: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, HandlerErrorCode: InvalidRequest), IsCustomResource: false
```
### Additional information
N/A
### Before submitting, please confirm:
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.
Contributor guide
Research direction
Reproduce the issue with the listed amplify init, env checkout, add auth, status, and push steps, then inspect the CloudFormation events for UserPoolClient and UserPoolClientWeb. The work is done when federated Google auth can be pushed successfully to each backend environment without rollback.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, node.js, typescript
- Domain
- authentication, cli, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100