aws-amplify / aws-amplify/docs

identityPool guest data access fails for authenticated users when amplify ssr is true

Open
#8,095 19 comments 2 reactions 1 assignee Claimed by @chrisbonifacio View on GitHub
bug transferred
Dominant language
MDX
Stars
506
Forks
1.1k
Avg merge
3h 14m
Merged PRs (30d)
1

Description

### Environment information

```plain text
System:
OS: macOS 14.5
CPU: (16) arm64 Apple M3 Max
Memory: 2.39 GB / 64.00 GB
Shell: /bin/zsh
Binaries:
Node: 22.5.1 - ~/.nvm/versions/node/v22.5.1/bin/node
Yarn: undefined - undefined
npm: 10.8.2 - ~/.nvm/versions/node/v22.5.1/bin/npm
pnpm: undefined - undefined
NPM Packages:
@aws-amplify/auth-construct: 1.2.0
@aws-amplify/backend: 1.0.4
@aws-amplify/backend-auth: 1.1.0
@aws-amplify/backend-cli: 1.2.1
@aws-amplify/backend-data: 1.1.0
@aws-amplify/backend-deployer: 1.0.2
@aws-amplify/backend-function: 1.3.0
@aws-amplify/backend-output-schemas: 1.1.0
@aws-amplify/backend-output-storage: 1.0.2
@aws-amplify/backend-secret: 1.0.0
@aws-amplify/backend-storage: 1.0.4
@aws-amplify/cli-core: 1.1.1
@aws-amplify/client-config: 1.1.1
@aws-amplify/deployed-backend-client: 1.1.0
@aws-amplify/form-generator: 1.0.0
@aws-amplify/model-generator: 1.0.2
@aws-amplify/platform-core: 1.0.3
@aws-amplify/plugin-types: 1.1.0
@aws-amplify/sandbox: 1.1.1
@aws-amplify/schema-generator: 1.2.0
aws-amplify: 6.4.3
aws-cdk: 2.150.0
aws-cdk-lib: 2.150.0
typescript: 5.5.4
AWS environment variables:
AWS_STS_REGIONAL_ENDPOINTS = regional
AWS_NODEJS_CONNECTION_REUSE_ENABLED = 1
AWS_SDK_LOAD_CONFIG = 1
No CDK environment variables
```

### Data packages

```plain text
onlihoney.com.au@0.1.0 /Users/leonanderson/Sites/onlihoney.com.au
├─┬ @aws-amplify/backend-cli@1.2.1
│ └─┬ @aws-amplify/schema-generator@1.2.0
│ └── @aws-amplify/graphql-schema-generator@0.9.3
└─┬ @aws-amplify/backend@1.0.4
└─┬ @aws-amplify/backend-data@1.1.0
└── @aws-amplify/data-construct@1.9.3
```

### Description

### Current calls and issues
Data set up with access pattern.
```js
allow.guest().to("read"),
allow.authenticated("identityPool").to("read"),
allow.groups(["ADMINS"])
```
And call to data from front end home page
```js
Amplify.configure(outputs, { ssr: true });

const client = generateClient({ authMode: "identityPool" });
```

Unauthenticated (guest) user can access data.
Authenticated user (Signed in) cannot access data.
Receive error:
```
"UnauthorizedException: Unknown error\n at parseJsonError (webpack-internal:///(app-pages-browser)/./node_modules/@aws-amplify/core/dist/esm/clients/serde/json.mjs:34:19)\n at async parseRestApiServiceError (webpack-internal:///(app-pages-browser)/./node_modules/@aws-amplify/api-rest/dist/esm/utils/serviceError.mjs:26:28)\n at async job (webpack-internal:///(app-pages-browser)/./node_modules/@aws-amplify/api-rest/dist/esm/utils/createCancellableOperation.mjs:35:23)\n at async GraphQLAPIClass._graphql (webpack-internal:///(app-pages-browser)/./node_modules/@aws-amplify/api-graphql/dist/esm/internals/InternalGraphQLAPI.mjs:265:44)\n at async _list (webpack-internal:///(app-pages-browser)/./node_modules/@aws-amplify/data-schema/dist/esm/runtime/internals/operations/list.mjs:32:16)\n at async fetchProducts (webpack-internal:///(app-pages-browser)/./src/components/shoppingCart/ProductCards.js:27:48)"
```

With recovery suggestion:
```
"If you're calling an Amplify-generated API, make sure to set the "authMode" in generateClient({ authMode: '...' }) to the backend authorization rule's auth provider ('apiKey', 'userPool', 'iam', 'oidc', 'lambda')"
```
Note: No option listed for identityPool

This issue does not present if SSR True flag is not used:
```js
Amplify.configure(outputs);
```

However SSR is needed for my use case as I have API routes with SSR function calls to mutations etc.

### Expected behaviour.
ADMINS can read,write,delete data when calls to Data via userPool are made: Works
Authenticated users can read data when calls to Data via identityPool are made: **Error**
Guest users can read data when calls to Data via identityPool are made: Works

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.