aws-amplify / aws-amplify/amplify-hosting
Amplify Console no longer supplies IdP env variables into deployment
- Dominant language
- Dockerfile
- Stars
- 481
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
### Before opening, please confirm:
- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-hosting/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.
### App Id
d1vpcpmffes5uv
### AWS Region
us-east-1
### Amplify Hosting feature
Deployments, Environment variables
### Describe the bug
We have been running this app in dev and prod for over 2 years using Amplify Console for continuous deployments when new code is pushed. We are deploying the amplify backend which includes "auth" (Cognito) with Google as the only identity provider.
Deployments via Amplify Console/Hosting all of a sudden after 2 years started failing in November 2022 with the below error:
```
3df5ed87-1a99-43ea-a422-a30424667d8c INFO InvalidParameterException: client_id, client_secret and authorize_scopes are all required idp details.
at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:52:27)
at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:686:14)
at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)
at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)
at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10
at Request. (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)
at Request. (/var/runtime/node_modules/aws-sdk/lib/request.js:688:12)
at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:116:18)
3df5ed87-1a99-43ea-a422-a30424667d8c INFO Response body:
{
"Status": "FAILED",
"Reason": "See the details in CloudWatch Log Stream: 2022/11/15/[$LATEST]0da7d57b2efe4486ac48784740f9f3d4",
"PhysicalResourceId": "2022/11/15/[$LATEST]0da7d57b2efe4486ac48784740f9f3d4",
"StackId": "arn:aws:cloudformation:us-east",
"RequestId": "2d490769-bf9f-4b2d-aa77-fb017b5b0252",
"LogicalResourceId": "HostedUIProvidersCustomResourceInputs",
"NoEcho": false,
"Data": {
"err": {
"message": "client_id, client_secret and authorize_scopes are all required idp details.",
"code": "InvalidParameterException",
"time": "2022-11-15T21:05:25.252Z",
"requestId": "5e6a4b4b-9195-4188-bbfa-243c81b93fbc",
"statusCode": 400,
"retryable": false,
"retryDelay": 47.97010939295425
}
}
}
```
We have the 2 documented Amplify Console env variables defined: `AMPLIFY_GOOGLE_CLIENT_ID` and `AMPLIFY_GOOGLE_CLIENT_SECRET`. These env variables are defined here: https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html#amplify-console-environment-variables
It seems Amplify Console is no longer feeding these env variable values into the deployment.
This was a hot topic issue which was finally fixed and documented well, but there seems to have been a regression.
https://github.com/aws-amplify/amplify-hosting/issues/206#issuecomment-660498668
Deploying locally using `amplify push` to any of the same environments works fine as expected.
### Expected behavior
Deployment succeeds and the same Google identity provider works as expected.
### Reproduction steps
Create amplify app
Add gql api
Add auth with Google identity provider
In Amplify Console under App Setting > Env Variables add:
AMPLIFY_GOOGLE_CLIENT_ID
AMPLIFY_GOOGLE_CLIENT_SECRET
Set the branch to `All branches`
Deploy the app via Amplify Console
### Build Settings
Using default build image
Amplify CLI version latest
Amplify Console Env Variables add:
AMPLIFY_GOOGLE_CLIENT_ID
AMPLIFY_GOOGLE_CLIENT_SECRET
Set the branch setting to `All branches`
### Log output
I have added a single log statement into the `HostedUIProvidersCustomResourceInputs` lambda to view the contents of the lambda hander event object which makes it very easy to see that `hostedUIProviderCreds` is missing the `client_id` and `client_secret` fields when deployed via Amplify Console:
```
ResourceProperties: {
ServiceToken: 'HostedUIProvidersCustomR-1V0A59RZFHZM6',
hostedUIProviderMeta: '[{"ProviderName":"Google","authorize_scopes":"openid email profile","AttributeMapping":{"email":"email","username":"sub","name":"name","given_name":"given_name","family_name":"family_name"}}]',
userPoolId: 'us-east-',
hostedUIProviderCreds: '[{"ProviderName":"Google"}]'
},
OldResourceProperties: {
ServiceToken: 'HostedUIProvidersCustomR-1V0A59RZFHZM6',
hostedUIProviderMeta: '[{"ProviderName":"Google","authorize_scopes":"openid email profile","AttributeMapping":{"email":"email","username":"sub","name":"name","given_name":"given_name","family_name":"family_name"}}]',
userPoolId: 'us-east-',
hostedUIProviderCreds: '[{"ProviderName":"Google","client_id":"","client_secret":""}]'
}
```
### Additional information
_No response_
Contributor guide
Research direction
Start with the HostedUIProvidersCustomResourceInputs Lambda and the Amplify Console environment-variable handling described in the issue; compare its deployment event with a working local amplify push. Reproduce the Google identity-provider deployment using AMPLIFY_GOOGLE_CLIENT_ID and AMPLIFY_GOOGLE_CLIENT_SECRET, then verify that the credentials reach the custom resource and the deployment succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- ci-cd, cloud, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100