aws-amplify / aws-amplify/amplify-hosting

Amplify Console no longer supplies IdP env variables into deployment

Open
#3,112 0 comments 0 reactions 0 assignees View on GitHub
backend-builds bug pending-triage
Dominant language
Dockerfile
Stars
481
Forks
123
PR merge metrics
No merged PRs in 30d

Description

### Before opening, please confirm:

- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-hosting/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

### App Id

d1vpcpmffes5uv

### AWS Region

us-east-1

### Amplify Hosting feature

Deployments, Environment variables

### Describe the bug

We have been running this app in dev and prod for over 2 years using Amplify Console for continuous deployments when new code is pushed. We are deploying the amplify backend which includes "auth" (Cognito) with Google as the only identity provider.
Deployments via Amplify Console/Hosting all of a sudden after 2 years started failing in November 2022 with the below error:
```
3df5ed87-1a99-43ea-a422-a30424667d8c INFO InvalidParameterException: client_id, client_secret and authorize_scopes are all required idp details.
at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:52:27)
at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:686:14)
at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)
at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)
at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10
at Request. (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)
at Request. (/var/runtime/node_modules/aws-sdk/lib/request.js:688:12)
at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:116:18)

3df5ed87-1a99-43ea-a422-a30424667d8c INFO Response body:

{
"Status": "FAILED",
"Reason": "See the details in CloudWatch Log Stream: 2022/11/15/[$LATEST]0da7d57b2efe4486ac48784740f9f3d4",
"PhysicalResourceId": "2022/11/15/[$LATEST]0da7d57b2efe4486ac48784740f9f3d4",
"StackId": "arn:aws:cloudformation:us-east",
"RequestId": "2d490769-bf9f-4b2d-aa77-fb017b5b0252",
"LogicalResourceId": "HostedUIProvidersCustomResourceInputs",
"NoEcho": false,
"Data": {
"err": {
"message": "client_id, client_secret and authorize_scopes are all required idp details.",
"code": "InvalidParameterException",
"time": "2022-11-15T21:05:25.252Z",
"requestId": "5e6a4b4b-9195-4188-bbfa-243c81b93fbc",
"statusCode": 400,
"retryable": false,
"retryDelay": 47.97010939295425
}
}
}
```
We have the 2 documented Amplify Console env variables defined: `AMPLIFY_GOOGLE_CLIENT_ID` and `AMPLIFY_GOOGLE_CLIENT_SECRET`. These env variables are defined here: https://docs.aws.amazon.com/amplify/latest/userguide/environment-variables.html#amplify-console-environment-variables
It seems Amplify Console is no longer feeding these env variable values into the deployment.

This was a hot topic issue which was finally fixed and documented well, but there seems to have been a regression.
https://github.com/aws-amplify/amplify-hosting/issues/206#issuecomment-660498668

Deploying locally using `amplify push` to any of the same environments works fine as expected.

### Expected behavior

Deployment succeeds and the same Google identity provider works as expected.

### Reproduction steps

Create amplify app
Add gql api
Add auth with Google identity provider

In Amplify Console under App Setting > Env Variables add:
AMPLIFY_GOOGLE_CLIENT_ID
AMPLIFY_GOOGLE_CLIENT_SECRET
Set the branch to `All branches`

Deploy the app via Amplify Console

### Build Settings
Using default build image
Amplify CLI version latest

Amplify Console Env Variables add:
AMPLIFY_GOOGLE_CLIENT_ID
AMPLIFY_GOOGLE_CLIENT_SECRET
Set the branch setting to `All branches`

### Log output

I have added a single log statement into the `HostedUIProvidersCustomResourceInputs` lambda to view the contents of the lambda hander event object which makes it very easy to see that `hostedUIProviderCreds` is missing the `client_id` and `client_secret` fields when deployed via Amplify Console:
```
ResourceProperties: {
ServiceToken: 'HostedUIProvidersCustomR-1V0A59RZFHZM6',
hostedUIProviderMeta: '[{"ProviderName":"Google","authorize_scopes":"openid email profile","AttributeMapping":{"email":"email","username":"sub","name":"name","given_name":"given_name","family_name":"family_name"}}]',
userPoolId: 'us-east-',
hostedUIProviderCreds: '[{"ProviderName":"Google"}]'
},
OldResourceProperties: {
ServiceToken: 'HostedUIProvidersCustomR-1V0A59RZFHZM6',
hostedUIProviderMeta: '[{"ProviderName":"Google","authorize_scopes":"openid email profile","AttributeMapping":{"email":"email","username":"sub","name":"name","given_name":"given_name","family_name":"family_name"}}]',
userPoolId: 'us-east-',
hostedUIProviderCreds: '[{"ProviderName":"Google","client_id":"","client_secret":""}]'
}
```

### Additional information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the HostedUIProvidersCustomResourceInputs Lambda and the Amplify Console environment-variable handling described in the issue; compare its deployment event with a working local amplify push. Reproduce the Google identity-provider deployment using AMPLIFY_GOOGLE_CLIENT_ID and AMPLIFY_GOOGLE_CLIENT_SECRET, then verify that the credentials reach the custom resource and the deployment succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
ci-cd, cloud, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.