aws-amplify / aws-amplify/amplify-cli

User: arn:aws:sts::471112589329:assumed-role/eu-central-1_Ad25tEyii_Full-access/amplifyadmin is not authorized to perform: cognito-idp:GetGroup

Open
#13,901 3 comments 0 reactions 0 assignees View on GitHub
auth bug functions
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### How did you install the Amplify CLI?

_No response_

### If applicable, what version of Node.js are you using?

_No response_

### Amplify CLI Version

12.12.4

### What operating system are you using?

Mac

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No

### Describe the bug

When I do,
amplify add env ...
amplify push
I am getting error

Name: SubscribedGroup (AWS::Cognito::UserPoolGroup), Event Type: create, Reason: Resource handler returned message: "User: arn:aws:sts::471112589329:assumed-role/eu-central-1_Ad25tEyii_Full-access/amplifyadmin is not authorized to perform: cognito-idp:GetGroup on resource: arn:aws:cognito-idp:eu-central-1:471112589329:userpool/eu-central-1_0WJJ5Y05O because no identity-based policy allows the cognito-idp:GetGroup action (Service: CognitoIdentityProvider, Status Code: 400, Request ID: fb4dc113-81ac-4742-841b-f90717fcc71a)" (RequestToken: 94514ba1-38ef-acfb-0010-bcba2ca044b6, HandlerErrorCode: GeneralServiceException), IsCustomResource: false

### Expected behavior

Push to new env.

### Reproduction steps

amplify push

### Project Identifier

_No response_

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_

### Before submitting, please confirm:

- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported sequence, `amplify add env` followed by `amplify push`, and inspect the AWS Cognito `GetGroup` authorization error for the assumed role. Trace how the new environment creates the `AWS::Cognito::UserPoolGroup`; done means the push completes successfully without this authorization failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.