aws-amplify / aws-amplify/amplify-cli
User: arn:aws:sts::471112589329:assumed-role/eu-central-1_Ad25tEyii_Full-access/amplifyadmin is not authorized to perform: cognito-idp:GetGroup
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### How did you install the Amplify CLI?
_No response_
### If applicable, what version of Node.js are you using?
_No response_
### Amplify CLI Version
12.12.4
### What operating system are you using?
Mac
### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
No
### Describe the bug
When I do,
amplify add env ...
amplify push
I am getting error
Name: SubscribedGroup (AWS::Cognito::UserPoolGroup), Event Type: create, Reason: Resource handler returned message: "User: arn:aws:sts::471112589329:assumed-role/eu-central-1_Ad25tEyii_Full-access/amplifyadmin is not authorized to perform: cognito-idp:GetGroup on resource: arn:aws:cognito-idp:eu-central-1:471112589329:userpool/eu-central-1_0WJJ5Y05O because no identity-based policy allows the cognito-idp:GetGroup action (Service: CognitoIdentityProvider, Status Code: 400, Request ID: fb4dc113-81ac-4742-841b-f90717fcc71a)" (RequestToken: 94514ba1-38ef-acfb-0010-bcba2ca044b6, HandlerErrorCode: GeneralServiceException), IsCustomResource: false
### Expected behavior
Push to new env.
### Reproduction steps
amplify push
### Project Identifier
_No response_
### Log output
```
# Put your logs below this line
```
### Additional information
_No response_
### Before submitting, please confirm:
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.
Contributor guide
Research direction
Start by reproducing the reported sequence, `amplify add env` followed by `amplify push`, and inspect the AWS Cognito `GetGroup` authorization error for the assumed role. Trace how the new environment creates the `AWS::Cognito::UserPoolGroup`; done means the push completes successfully without this authorization failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- authentication, cli, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100