aws-amplify / aws-amplify/amplify-hosting

arn:aws:iam::aws:policy/AdministratorAccess-Amplify needs cognito-idp:ListIdentityProviders when using "amplify import auth" and continuous deployment

Open
#2,285 4 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
Dockerfile
Stars
481
Forks
123
PR merge metrics
No merged PRs in 30d

Description

### Before opening, please confirm:

- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-console/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-console/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-console/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

### App Id

_No response_

### Region

_No response_

### Amplify Console feature

Backend builds

### Describe the bug

Build raises exception:
User: arn:aws:sts::123456789:assumed-role/amplifyconsole-backend-role/BuildSession is not authorized to perform: cognito-idp:ListIdentityProviders on resource: arn:aws:cognito-idp:us-east-1:123456789:userpool/us-east-1_XYZABC because no identity-based policy allows the cognito-idp:ListIdentityProviders action

### Expected behavior

Should be able to connect repository and have first build get as far as running the framework build command (eg. npm run script build). Code build failures would be excused, but never makes it that far.

### Reproduction steps

1. Create app and add to amplify: amplify init
2. Create or find existing Cognito Identity Pool and User Pool: amplify import auth
3. Connect repository (eg. GitHub): amplify add hosting
This requires to use or create role. Create new role using selected defaults (Amplify, arn:aws:iam::aws:policy/AdministratorAccess-Amplify)
5. Build or rebuild app: Exception!

### Build Settings

```yaml
Using default generated amplify.yml
```

### Additional information

As a workaround, add cognito-idp:ListIdentityProviders as inline policy to service role (eg. amplifyconsole-backend-role).

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the backend build after `amplify import auth` and inspect the `amplifyconsole-backend-role` policy used by the build. Confirm that the missing `cognito-idp:ListIdentityProviders` permission is the blocker; done means the first build reaches the framework build command without this authorization error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
authentication, cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.