aws-amplify / aws-amplify/amplify-hosting
Unable to automatically provision backend for previews when application has Google Oauth
- Dominant language
- Dockerfile
- Stars
- 481
- Forks
- 123
- PR merge metrics
- No merged PRs in 30d
Description
### Before opening, please confirm:
- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-hosting/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [x] I have removed any sensitive information from my code snippets and submission.
### App Id
d2rkwhxguawvjc
### AWS Region
us-west-2
### Amplify Hosting feature
Backend builds, Web previews
### Describe the bug
My Amplify application has Google Oauth, and previews fail to create an ephemeral backend during pull requests because the auth resources fail to create.

### Expected behavior
A preview should create a new ephemeral backend even when the application has social auth providers like Google.
### Reproduction steps
1. Add Google Oauth provider to an amplify application
2. Enable previews and select `Create new backend environment for every Pull Request` option
3. Create a pull request and wait to see if the backend is created successfully.
### Build Settings
```yaml
version: 1
backend:
phases:
build:
commands:
- '# Execute Amplify CLI with the helper script'
- amplifyPush --simple
frontend:
phases:
preBuild:
commands:
- npm ci
build:
commands:
- npm run build
artifacts:
baseDirectory: .next
files:
- '**/*'
cache:
paths:
- 'node_modules/**/*'
- '.next/cache/**/*'
```
### Log output
```
# Put your logs below this line
{
"Status": "FAILED",
"Reason": "See the details in CloudWatch Log Stream: 20XX/XX/XX/[$LATEST]XXXXXXXXXXXX",
"PhysicalResourceId": "20XX/XX/XX/[$LATEST]XXXXXXXXXXXX",
"StackId": "arn:aws:cloudformation:us-west-2:XXXXXXXX:stack/amplify-XXXXXXX-XXXXXX-XXXXXXX-XXXXX-XXXXX/XXXXXXXX",
"RequestId": "XXXXXXXXXXXXXXXXX",
"LogicalResourceId": "OAuthCustomResourceInputs",
"NoEcho": false,
"Data": {
"err": {
"message": "The provider Google does not exist for User Pool us-west-2XXXXXXXXX.",
"code": "InvalidParameterException",
"time": "XXXXXXXX",
"requestId": "XXXXXXXXX",
"statusCode": 400,
"retryable": false,
"retryDelay": 69.68117398457674
}
}
}
```
### Additional information
The error occurs in the `OAuthCustomResourceInputs` custom resource in the auth stack.

I downloaded the preview root stack from the s3 bucket and compared it to the root stack from an existing backend that works fine. I noticed that there were no values provided for the `hostedUIProviderCreds` in the preview root stack, the value defaulted to `"hostedUIProviderCreds": "[]"`
For example, the existing backend root stack has this:
```
"authXXXXXXXXXX": {
"Type": "AWS::CloudFormation::Stack",
"Properties": {
"TemplateURL": "https://s3.amazonaws.com/amplify-XXXXXXXapp-XXXX-XXXX-deployment/amplify-cfn-templates/auth/XXXXXXXXXX-cloudformation-template.json",
"Parameters": {
...,
"googleClientId": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com",
"oAuthMetadata": "{\"AllowedOAuthFlows\":[\"code\"],\"AllowedOAuthScopes\":[\"phone\",\"email\",\"openid\",\"profile\",\"aws.cognito.signin.user.admin\"],\"CallbackURLs\":[XXXXXX],\"LogoutURLs\":[XXXXXX]}",
"hostedUIProviderCreds": "[{\"ProviderName\":\"Google\",\"client_id\":\"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com\",\"client_secret\":\"XXXXXXXXXXXXXXXXXXXXX\"}]",
"env": "XXXX"
}
}
}
```
The preview root stack has this:
```
"authXXXXXXXXXX": {
"Type": "AWS::CloudFormation::Stack",
"Properties": {
"TemplateURL": "https://s3.amazonaws.com/amplify-XXXXXXXapp-XXXX-XXXX-deployment/amplify-cfn-templates/auth/XXXXXXXXXX-cloudformation-template.json",
"Parameters": {
...,
"googleClientId": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.apps.googleusercontent.com",
"oAuthMetadata": "{\"AllowedOAuthFlows\":[\"code\"],\"AllowedOAuthScopes\":[\"phone\",\"email\",\"openid\",\"profile\",\"aws.cognito.signin.user.admin\"],\"CallbackURLs\":[XXXXXXXX],\"LogoutURLs\":[XXXXXX]}",
"hostedUIProviderCreds": "[]",
"env": "XXXX"
}
}
}
```
The application makes use of google Oauth, and the Google client secret appears not to be present in the web preview backends, even though the `AMPLIFY_GOOGLE_CLIENT_SECRET` environment variable is visible by all branches.
I manually added the `hostedUIProviderCreds` in the preview root stack and tried to create it in the CloudFormation console from that template. It created all the auth resources successfully. So I suspect that the absence of `hostedUIProviderCreds` in the preview root stack is the cause of the issue.
Contributor guide
Research direction
Inspect the preview root stack and auth stack parameters, focusing on the OAuthCustomResourceInputs custom resource and hostedUIProviderCreds. Compare preview and existing backend templates, then reproduce a preview with Google OAuth. Done means the ephemeral backend creates its auth resources and the preview succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- authentication, ci-cd, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100