aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

CloudFormation marks duplicate AWS::Cognito::UserPoolIdentityProvider as CREATE_COMPLETE and does not report the error from failed CreateIdentityProvider

Open
#1,287 0 comments 0 reactions 0 assignees View on GitHub
bug NeedTriage
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::Cognito::UserPoolIdentityProvider

### Resource Name

_No response_

### Issue Description

If you try to create a **AWS::Cognito::UserPoolIdentityProvider** resource with a provider name that exists, CloudFormation marks the resource CREATE_COMPLETE.

CloudTrail event shows that **CreateIdentityProvider** fails with `DuplicateProviderException`: `" already exists in user pool "` but the error is not reported to CloudFormation.

### Expected Behavior

CloudFormation reports the error from **CreateIdentityProvider** on stack events page and does not mark the resource **CREATE_COMPLETE**.

### Observed Behavior

CloudFormation invokes CreateIdentityProvider, which fails, but then marks **AWS::Cognito::UserPoolIdentityProvider** as **CREATE_COMPLETE**.

### Test Cases

**Steps to replicate issue:**
1. Create stack using template below.
2. Remove commented out UserPoolIdentityProvider2, update stack.

**Template:**
```
Resources:
CognitoUserPool:
Type: AWS::Cognito::UserPool
Properties:
UserPoolName: MyPoolOfUsers

UserPoolIdentityProvider:
Type: AWS::Cognito::UserPoolIdentityProvider
Properties:
UserPoolId: !Ref CognitoUserPool
ProviderName: "LoginWithAmazon"
ProviderDetails:
client_id: "YourLoginWithAmazonAppId"
client_secret: "YourLoginWithAmazonAppSecret"
authorize_scopes: "profile postal_code"
ProviderType: "LoginWithAmazon"
AttributeMapping:
email: "email"

# UserPoolIdentityProvider2:
# Type: AWS::Cognito::UserPoolIdentityProvider
# Properties:
# UserPoolId: !Ref CognitoUserPool
# ProviderName: "LoginWithAmazon"
# ProviderDetails:
# client_id: "YourLoginWithAmazonAppId"
# client_secret: "YourLoginWithAmazonAppSecret"
# authorize_scopes: "profile postal_code"
# ProviderType: "LoginWithAmazon"
# AttributeMapping:
# email: "email"
```

### Other Details

[AWS::Cognito::UserPoolIdentityProvider](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolidentityprovider.html)

[CreateIdentityProvider](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html)

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the provided CloudFormation template by creating the duplicate AWS::Cognito::UserPoolIdentityProvider and reviewing the stack events and CloudTrail CreateIdentityProvider result. Done means the DuplicateProviderException is reported in CloudFormation and the resource is not marked CREATE_COMPLETE.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.