aws-amplify / aws-amplify/amplify-cli

Custom user pool not referenced in a function's cloudformation template

Open
#8,533 3 comments 0 reactions 0 assignees View on GitHub
auth bug multienv p2
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### Before opening, please confirm:

- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

15.4.0

### Amplify CLI Version

6.3.1

### What operating system are you using?

Ubuntu

### Amplify Categories

auth, function

### Amplify Commands

Not applicable

### Describe the bug

We have two env - `dev` and `staging`.

Further, note that we have created a user pool in Cognito ourselves and imported it in amplify. It was not generated using amplify. This has been carried out in both the environments (one developer works only in the dev environment while the other works on staging, and uses their own aws credentials / profile). The 2 environments are not on the same AWS account.

Now, in staging environment, I have created a function (through amplify) and given it access permissions to create / read and update the cognito user pool (again, through amplify itself).

I observed this in the function's cloudformation-template.json file:

```json
"Resource": [
{
"Fn::Join": [
"",
[
"arn:aws:cognito-idp:",
{
"Ref": "AWS::Region"
},
":",
{
"Ref": "AWS::AccountId"
},
":userpool/",
"us-east-"
]
]
}
]
```

This is located under the `Resources.AmplifyResourcesPolicy.Properties.PolicyDocument.Statement[0]` attribute, which has assigned the permissions to access the cognito user pool.

I point to the ` "us-east-"` bit of the above - where redacted here is the user pool id of the cognito user pool in the `staging` environment. It seems to have hard coded the user pool id. Should it not reference the user pool id configured instead?

If I switch the environment to dev, the user pool id continues to be the one from the staging environment (in the above).

We are experiencing, on occasion, an issue with the auth access when switching environments, and I _think_ this is why - though I am not able to really confirm it.

### Expected behavior

The cloudformation template should refer to the configured user pool id instead of hard coding it.

### Reproduction steps

Steps provided under description

### GraphQL schema(s)

```graphql
# Put schemas below this line

```

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.