aws-amplify / aws-amplify/amplify-cli

Cannot push new auth on more than one backend environment when using federated auth

Open
#13,501 2 comments 0 reactions 0 assignees View on GitHub
auth bug multienv p2
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### How did you install the Amplify CLI?

curl

### If applicable, what version of Node.js are you using?

20.10.0

### Amplify CLI Version

12.10.0

### What operating system are you using?

Mac

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No manual changes made.

### Describe the bug

I am attempting to add federated auth (Google) to my amplify app, with three backend environments (dev, test, prod).
When I run `amplify add auth` and follow the steps on my dev environment, the `amplify push` works fine and all the resources are correctly created.

Then if I checkout one of the two other environments (ex: `amplify checkout env test`) and attempt to push my backend, it fails and rolls back with the error stack below. Same with the prod environment.

### Expected behavior

Upon pushing in a different backend environment, each environment has its own Cognito user pool. All user pools, one for each environment, have the same configuration and use the same provider web client ID and secret.

### Reproduction steps

1. `mkdir whatever`
2. `cd whatever`
3. `amplify init`
4. `amplify add env test`
5. `amplify checkout env dev`
6. `amplify add auth` (below are my selections)

* Default configuration with Social Provider (Federation)
* Email
* Yes I want to make some additional changes
* Select email, given name, family name, picture
* Next step, do not select any additional capabilities
* Use default prefix
* Sign in URI : http://localhost:3000/
* No additional sign in URI
* Sign out URI : http://localhost:3000/
* No additional sign out URI
* Select only Google in the provider list
* Enter a valid Web Client ID. Mine looks approximately like this: 000000000000-xxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com
* Enter a valid Web Client Secret: : XXXXXX-XXXXXXXXX_XXXXXXXXXXXXX

7. `amplify push`
8. `amplify checkout env test`
9. `amplify status` (note here that auth is to be updated)
10. `amplify push`

### Project Identifier

8ce6a4a3421c34deb27784cf3925bcfb

### Log output

```
Deployment failed.
Deploying root stack dnsauditor [ ====================-------------------- ] 3/6
amplify-dnsauditor-test-191549 AWS::CloudFormation::Stack UPDATE_ROLLBACK_COMPLETE_CLE
apidnsauditor AWS::CloudFormation::Stack UPDATE_COMPLETE
functionaudit AWS::CloudFormation::Stack UPDATE_COMPLETE
authdnsauditorc9fb2a0b AWS::CloudFormation::Stack UPDATE_FAILED
apiaudit AWS::CloudFormation::Stack UPDATE_COMPLETE
Deploying auth dnsauditorc9fb2a0b [ ===------------------------------------- ] 1/14
HostedUIProvidersCustomResour… Custom::LambdaCallout UPDATE_COMPLETE
UserPoolClientWeb AWS::Cognito::UserPoolClient UPDATE_FAILED
UserPoolClient AWS::Cognito::UserPoolClient UPDATE_FAILED

🛑 The following resources failed to deploy:
Resource Name: UserPoolClient (AWS::Cognito::UserPoolClient)
Event Type: update
Reason: Resource handler returned message: "The provider Google does not exist for User Pool ca-central-1_XXXXXXXXXX. (Service: CognitoIdentityProvider, Status Code: 400, Request ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)" (RequestToken: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, HandlerErrorCode: InvalidRequest)
URL: https://console.aws.amazon.com/cloudformation/home?region=ca-central-1#/stacks/arn%3Aaws%3Acloudformation%3Aca-central-1%3A590382766331%3Astack%2Famplify-dnsauditor-test-191549-authdnsauditorc9fb2a0b-UHL0KWC41QBO%2F4cd9d740-a040-11ee-b8ca-0e529d418748/events

Resource Name: UserPoolClientWeb (AWS::Cognito::UserPoolClient)
Event Type: update
Reason: Resource handler returned message: "The provider Google does not exist for User Pool ca-central-1_XXXXXXXXXX. (Service: CognitoIdentityProvider, Status Code: 400, Request ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)" (RequestToken: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, HandlerErrorCode: InvalidRequest)
URL: https://console.aws.amazon.com/cloudformation/home?region=ca-central-1#/stacks/arn%3Aaws%3Acloudformation%3Aca-central-1%3A590382766331%3Astack%2Famplify-dnsauditor-test-191549-authdnsauditorc9fb2a0b-UHL0KWC41QBO%2F4cd9d740-a040-11ee-b8ca-0e529d418748/events

🛑 Resource is not in the state stackUpdateComplete
Name: UserPoolClient (AWS::Cognito::UserPoolClient), Event Type: update, Reason: Resource handler returned message: "The provider Google does not exist for User Pool ca-central-1_XXXXXXXXXX. (Service: CognitoIdentityProvider, Status Code: 400, Request ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)" (RequestToken: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, HandlerErrorCode: InvalidRequest), IsCustomResource: false

Name: UserPoolClientWeb (AWS::Cognito::UserPoolClient), Event Type: update, Reason: Resource handler returned message: "The provider Google does not exist for User Pool ca-central-1_XXXXXXXXXX. (Service: CognitoIdentityProvider, Status Code: 400, Request ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)" (RequestToken: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, HandlerErrorCode: InvalidRequest), IsCustomResource: false

```

### Additional information

N/A

### Before submitting, please confirm:

- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the listed amplify init, env checkout, add auth, status, and push steps, then inspect the CloudFormation events for UserPoolClient and UserPoolClientWeb. The work is done when federated Google auth can be pushed successfully to each backend environment without rollback.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, node.js, typescript
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.