aws-amplify / aws-amplify/amplify-hosting
arn:aws:iam::aws:policy/AdministratorAccess-Amplify needs cognito-idp:ListIdentityProviders when using "amplify import auth" and continuous deployment
- Dominant language
- Dockerfile
- Stars
- 481
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
### Before opening, please confirm:
- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-console/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-console/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-console/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
### App Id
_No response_
### Region
_No response_
### Amplify Console feature
Backend builds
### Describe the bug
Build raises exception:
User: arn:aws:sts::123456789:assumed-role/amplifyconsole-backend-role/BuildSession is not authorized to perform: cognito-idp:ListIdentityProviders on resource: arn:aws:cognito-idp:us-east-1:123456789:userpool/us-east-1_XYZABC because no identity-based policy allows the cognito-idp:ListIdentityProviders action
### Expected behavior
Should be able to connect repository and have first build get as far as running the framework build command (eg. npm run script build). Code build failures would be excused, but never makes it that far.
### Reproduction steps
1. Create app and add to amplify: amplify init
2. Create or find existing Cognito Identity Pool and User Pool: amplify import auth
3. Connect repository (eg. GitHub): amplify add hosting
This requires to use or create role. Create new role using selected defaults (Amplify, arn:aws:iam::aws:policy/AdministratorAccess-Amplify)
5. Build or rebuild app: Exception!
### Build Settings
```yaml
Using default generated amplify.yml
```
### Additional information
As a workaround, add cognito-idp:ListIdentityProviders as inline policy to service role (eg. amplifyconsole-backend-role).
Contributor guide
Research direction
Start by reproducing the backend build after `amplify import auth` and inspect the `amplifyconsole-backend-role` policy used by the build. Confirm that the missing `cognito-idp:ListIdentityProviders` permission is the blocker; done means the first build reaches the framework build command without this authorization error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- authentication, cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100